Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
shin_amuro
New Contributor

Login failed from 127.0.0.1

Hi,

 

I am getting the following log every around 15 minutes on my 50E.

 

Administrator admin login failed from http(127.0.0.1) because of invalid password

 

Any has any idea on what is this could be?

 

Thanks

1 Solution
Wayne11
Contributor

I bet you use FortiAnalyzer. Check the login credentials you have configured on both sides, on the FAZ and the FG.

View solution in original post

12 REPLIES 12
Wayne11
Contributor

I bet you use FortiAnalyzer. Check the login credentials you have configured on both sides, on the FAZ and the FG.

View solution in original post

plz
New Contributor

Wayne1 wrote:

I bet you use FortiAnalyzer. Check the login credentials you have configured on both sides, on the FAZ and the FG.

 

Wayne1, my login credentials FG201E is the same as FAZ200F. 

i also got this event log and my customer wondering what is this "Administrator admin login failed from http(127.0.0.1) because of invalid password" anyone can explain to me.

Hosemacht
Contributor II

Hey there,

 

i think he means : go to you Analyzer-> Device Management -> Edit your Device and edit Admin User and Password.

 

Regards

sudo apt-get-rekt

emnoc
Esteemed Contributor III

Do you have a cluster?  The  FGT in a cluster uses  127.0.0.1 and telnet now that I think about it. Never seen http and the localhost in a admin auth messages.

 

Also add, make sure you  do not have a fortiexplorer hooked up to the  Fortigate, it also uses  127.0.0.1 and telnet. I bet this is your case and something is triggering because of this.

 

PCNSE 

NSE 

StrongSwan  

plz
New Contributor

emnoc wrote:

Do you have a cluster?  The  FGT in a cluster uses  127.0.0.1 and telnet now that I think about it. Never seen http and the localhost in a admin auth messages.

 

Also add, make sure you  do not have a fortiexplorer hooked up to the  Fortigate, it also uses  127.0.0.1 and telnet. I bet this is your case and something is triggering because of this.

 

 

Hi emnoc,

Thank you so much for your reply. i think that make sense and i i disable FortiTelemetry. waiting for result checked. 

 

plz
New Contributor

emnoc wrote:

Do you have a cluster?  The  FGT in a cluster uses  127.0.0.1 and telnet now that I think about it. Never seen http and the localhost in a admin auth messages.

 

Also add, make sure you  do not have a fortiexplorer hooked up to the  Fortigate, it also uses  127.0.0.1 and telnet. I bet this is your case and something is triggering because of this.

 

Yes i have cluster and i try to find how to disable fortiexplorer or some thing related this behavior i can not found.

do you have recommend to do this.

plz
New Contributor

the_giraffe_that_wasnt_president wrote:

Hey there,

 

i think he means : go to you Analyzer-> Device Management -> Edit your Device and edit Admin User and Password.

 

Regards

it is the same admin and password.

plz
New Contributor

the_giraffe_that_wasnt_president wrote:

Hey there,

 

i think he means : go to you Analyzer-> Device Management -> Edit your Device and edit Admin User and Password.

 

Regards

Ok this issue was solve. Thanks.

Prab
New Contributor

This can also happen if you are managing the FGT from a FortiManager. The above solution will fix this issue.