Hot!Issue logging into firewall FG 60C

Author
champ2152
New Member
  • Total Posts : 7
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/06/18 10:09:54
  • Status: offline
2018/06/18 10:16:59 (permalink)
0

Issue logging into firewall FG 60C

Hello,
We have been getting messages on the firewall that remote user has been trying to get access. The message was "Failed admin authentication attempt for root". I did some searching and found out a way to trust certain IP's in the admin section.
So I decided to add my public IP for this trusted admin log in's. No sure if this was right way in hind sight.
Anyway now I am not able to access the web interface internally. Not sure if the local IP had to be added.
 
I downloaded Fortiexplorer and connected it via USB cable. I am able to connect to the firewall but the log in still does not work connected via cable.
 
Is their any other way around this besides resetting the entire firewall settings?
 
Any help is greatly appreciated. 
#1

12 Replies Related Threads

    Toshi Esumi
    Expert Member
    • Total Posts : 1129
    • Scores: 66
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Issue logging into firewall FG 60C 2018/06/18 12:15:31 (permalink)
    0
    By default FGT accepts any remote admin accesses on the interfaces that are configured to accept those accesses. Once you configured a "trusthost" in administrator config (not 0.0.0.0/0) it starts limitting access only to those hosts (otherwise trusthosts don't mean anything). If you want to allow access from inside as well, you need to specify the LAN subnet to trusthost2 or other.
    #2
    champ2152
    New Member
    • Total Posts : 7
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/06/18 10:09:54
    • Status: offline
    Re: Issue logging into firewall FG 60C 2018/06/18 12:21:50 (permalink)
    0
    toshiesumi
    By default FGT accepts any remote admin accesses on the interfaces that are configured to accept those accesses. Once you configured a "trusthost" in administrator config (not 0.0.0.0/0) it starts limitting access only to those hosts (otherwise trusthosts don't mean anything). If you want to allow access from inside as well, you need to specify the LAN subnet to trusthost2 or other.


    So i would need to put my public ip in the first trusthost and then my local ip in the trusthost 2? If i put the public ip in the first trusted host shouldnt any computer with that public IP be able to access it?
    #3
    Toshi Esumi
    Expert Member
    • Total Posts : 1129
    • Scores: 66
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Issue logging into firewall FG 60C 2018/06/18 13:07:40 (permalink)
    0
    The trusthosts are trusted host IPs that FGT see as in the source IP. When you're accessing from outside, the FGT would see your public IP. When you're connected from inside, it sees your internal IP. If you don't need access from outisde interface, I would recommend not to allow access on the outside interface at all but allow it only on the internal interface.
    #4
    champ2152
    New Member
    • Total Posts : 7
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/06/18 10:09:54
    • Status: offline
    Re: Issue logging into firewall FG 60C 2018/06/18 13:12:25 (permalink)
    0
    toshiesumi
    The trusthosts are trusted host IPs that FGT see as in the source IP. When you're accessing from outside, the FGT would see your public IP. When you're connected from inside, it sees your internal IP. If you don't need access from outisde interface, I would recommend not to allow access on the outside interface at all but allow it only on the internal interface.


    How would you allow on the internal interface only? Just use the local ip in the trusted hosts?
    Also do you know anyway to get back into the interface. Because now after i changed the trusted ip to my public IP i can not access the portal.
    #5
    Toshi Esumi
    Expert Member
    • Total Posts : 1129
    • Scores: 66
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Issue logging into firewall FG 60C 2018/06/18 13:16:41 (permalink)
    0
    On each interface, there are check boxes in GUI, or "set allowaccess" command to allow admin access and other protocols like https, ssh, and so on. Just uncheck those on the outside interface and allow them on the inside interface and use inside interface IP to access it from inside.
    #6
    champ2152
    New Member
    • Total Posts : 7
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/06/18 10:09:54
    • Status: offline
    Re: Issue logging into firewall FG 60C 2018/06/18 13:18:43 (permalink)
    0
    toshiesumi
    On each interface, there are check boxes in GUI, or "set allowaccess" command to allow admin access and other protocols like https, ssh, and so on. Just uncheck those on the outside interface and allow them on the inside interface and use inside interface IP to access it from inside.


    Ok I will do that then. Any idea if their is a way to get back on my device without resetting the firewall?
    #7
    Toshi Esumi
    Expert Member
    • Total Posts : 1129
    • Scores: 66
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Issue logging into firewall FG 60C 2018/06/18 13:23:06 (permalink)
    0
    To just regain the access via the interfaces, either adding your source IP or remove all trusthosts you configured (sounds like only one) would do it. I don't see any reason you have to reboot (wouldn't solve it anyway) or factory-reset it.
    #8
    champ2152
    New Member
    • Total Posts : 7
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/06/18 10:09:54
    • Status: offline
    Re: Issue logging into firewall FG 60C 2018/06/18 13:25:58 (permalink)
    0
    Right but i can not access the interface is the problem. When i try to access the interface from the USB directly connecting the logins do not work. My guess is because I put the public IP in the admin access.
    So currently i am not able to log into the firewall portal. That is my current issue. 
    #9
    Toshi Esumi
    Expert Member
    • Total Posts : 1129
    • Scores: 66
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Issue logging into firewall FG 60C 2018/06/18 13:28:46 (permalink)
    0
    Use the console (serial) port. That's the last resort.
    #10
    champ2152
    New Member
    • Total Posts : 7
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/06/18 10:09:54
    • Status: offline
    Re: Issue logging into firewall FG 60C 2018/06/18 13:32:11 (permalink)
    0
    toshiesumi
    Use the console (serial) port. That's the last resort.


    I tried the usb port and was able to get to the command line but it still wont let me log in. Tells me my password is invalid.
    #11
    Toshi Esumi
    Expert Member
    • Total Posts : 1129
    • Scores: 66
    • Reward points: 0
    • Joined: 2014/11/06 09:56:42
    • Status: offline
    Re: Issue logging into firewall FG 60C 2018/06/18 13:49:19 (permalink)
    0
    That's a different problem unrelated to trusthosts. You need to do password recovery procedure described in the video below.
    https://www.youtube.com/watch?v=DAChWOsViX0
     
     
     
     
    #12
    champ2152
    New Member
    • Total Posts : 7
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/06/18 10:09:54
    • Status: offline
    Re: Issue logging into firewall FG 60C 2018/06/18 13:52:30 (permalink)
    0
    Right I understand it is a different issue. But changing this caused the problem when i can not access and log in. I was just explaining how i got this issue. I know my password but for some reason i think because of this trust its having an issue. I will check your video.
    #13
    Jump to:
    © 2018 APG vNext Commercial Version 5.5