Neither there is no strong need to block those “very basic” attack because this attack is not very sophisticated and should have no effect on a well secured setup. We discussed a lot of possible solutions and came to the conclusion, that there is no simple way to block these attacks.

Only SSL-VPN Sites on Port 10443 are being attacked, Portals running on other ports like 443 are not (yet).

Only a few usernames are being tried: admin, administrador, administrator, user, vpn, vpnuser, aadmin, badmin, cadmin, dadmin … zadmin, and few more.

Not all FortiGates that are connected and reachable publicly over the internet are affected.

Almost every login try is coming from a different source IP to prevent a block.

A lot means around 5-20 events per hour.

A lot of failed login events are being logged.

Lets summarize what we have found out until today: Most of the administrators saw a rised number of the following log messages in the “VPN Event Log” on the FortiGate / FortiAnalyzer.Īnd no, there’s no spelling mistakes in the title… That’s the way the log message is named: date= time=11:22:33 logid='0101039426' type='event' subtype='vpn' level='alert' vd='root' eventtime=1629710539 logdesc='SSL VPN login fail' action='ssl-login-fail' tunneltype='ssl-web' tunnelid=0 remip=11.22.33.44 user='administrador' group='N/A' dst_host='N/A' reason='sslvpn_login_permission_denied' msg='SSL user failed to logged in' Therefore, this post is still very relevant.) But messages are still shown from time to time, since scanning is going on over the internet all the time. (Edit: That was back in August of 2021 and the big “scanning” ended around two weeks after it has started.

Since last week, we observed a lot of failed SSL-VPN login events on various FortiGate setups.

Fortigate ssl vpn