Helpful ReplyHot!SSL VPN

Page: 12 > Showing page 1 of 2
Author
ianmclachlan
New Member
  • Total Posts : 14
  • Scores: 2
  • Reward points: 0
  • Joined: 2019/03/01 01:47:24
  • Status: offline
2021/08/19 02:11:10 (permalink)
0

SSL VPN

Hi Guys,
 
Does anyone have a guide/reference for setting up geo-blocking to restrict certain countries?  Multiple IP's from several countries are trying to bruteforce the VPN.  We don't have any VPN users needing access from outside the country.
 
Many thanks,
 
IM
 
 
#1
rg2017
Bronze Member
  • Total Posts : 22
  • Scores: 2
  • Reward points: 0
  • Joined: 2017/08/02 07:28:21
  • Status: offline
Re: SSL VPN 2021/08/19 06:10:16 (permalink)
0
Hello. You can create an address from Policy and Objects and specify a type of Geography. I'm seeing attempts in the past few days of someone trying to connect to VPN as "administrator" which isn't a valid user. They are coming from other countries. I've added geographical locations to a block policy, but the lists Fortinet provides don't appear to be complete as connections from the companies specified aren't blocked.
 
 
post edited by rg2017 - 2021/08/19 06:11:42
#2
ianmclachlan
New Member
  • Total Posts : 14
  • Scores: 2
  • Reward points: 0
  • Joined: 2019/03/01 01:47:24
  • Status: offline
Re: SSL VPN 2021/08/19 07:29:55 (permalink)
0
Strange, I'm getting the same attempts to login as "administrator" on two seperate sites on two different Fortinet's, hence my question.
 
I tried to set the source on "SSL-VPN Interface to LAN" to my country only.  But that blocked everyones access to systems/IP's on the LAN for some reason.
 
@rg2017 ...  where are you applying the geo policy?
 
#3
rg2017
Bronze Member
  • Total Posts : 22
  • Scores: 2
  • Reward points: 0
  • Joined: 2017/08/02 07:28:21
  • Status: offline
Re: SSL VPN 2021/08/19 08:08:03 (permalink) ☄ Helpfulby badnerone 2021/08/23 09:08:58
0
It is strange, indeed. It's only been happening for the last couple of days. It doesn't seem to be a brute-force attack. They only try once from each IP address, and the attempts are infrequent.
 
I created a policy that I placed at the top of the IPv4 policies list. It is setup to block traffic originating from whichever geographic locations I specify.
#4
ianmclachlan
New Member
  • Total Posts : 14
  • Scores: 2
  • Reward points: 0
  • Joined: 2019/03/01 01:47:24
  • Status: offline
Re: SSL VPN 2021/08/19 08:17:17 (permalink)
0
Exactly the same thing - (last couple of days, different IP's, mixture of admin and administrator ... and infrequent)  I assumed it was a BF, but so low not to trigger any account lockout or IDS.  Just common admin passwords ...
 
Good call on placing a policy at top of WAN > LAN blocking all traffic from a geo.  I'll give that a go.
#5
ihaqueit@gmail.com
New Member
  • Total Posts : 1
  • Scores: 0
  • Reward points: 0
  • Joined: 2021/08/19 12:01:36
  • Status: offline
Re: SSL VPN 2021/08/19 12:06:18 (permalink)
#6
shehab
New Member
  • Total Posts : 11
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/06/11 13:44:12
  • Status: offline
Re: SSL VPN 2021/08/19 19:36:49 (permalink)
0
Dear All,
 
We are facing the exact issue, a mixture of admin and administrator failed logins on the sslvpn.
 
Starting from 2021-08-18 , single trial and its keep on going in a shuffled timeframe ( or every 90 min).
 
BR,
Shehab
post edited by shehab - 2021/08/19 19:38:29
#7
Ger
New Member
  • Total Posts : 7
  • Scores: 2
  • Reward points: 0
  • Joined: 2021/08/20 12:18:30
  • Status: offline
Re: SSL VPN 2021/08/20 12:23:44 (permalink)
0
Hi, I'm having the same issue, mostly from india and malaysia. At first I tried to add the source ip as an address and the add those IP's to an address group, but I think this is not the best solution, I just create an user in this site to see if I can find information about this.
 
I don't know if add an address range to exlcude those IP's will work.. looking for more information about this.
 
I read that you can add those ip to quarantine, but after a reboot of the unit this will get lost.
 
 
#8
ronanlg
New Member
  • Total Posts : 1
  • Scores: 0
  • Reward points: 0
  • Joined: 2021/08/21 12:27:34
  • Status: offline
Re: SSL VPN 2021/08/21 13:11:33 (permalink)
0
Dear Forti users,
 
Same for me since 18th this month. 7 fortigates on independents sites in France, and same issues. Login attempts from different countries (BR, VN, KR, TH ...)- for users : "user",  "admin" and "administrator". I'm using 10443 port for SSL VPN, what is our port ? It's really strange...
 
I've applied a restriction to allow connections only from French IP.
 
Ronan.
 
post edited by ronanlg - 2021/08/21 13:12:42
#9
tomasbond
New Member
  • Total Posts : 3
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/11/12 10:39:25
  • Status: offline
Re: SSL VPN 2021/08/22 14:29:24 (permalink)
0
My fortigate VPN SSL is being brute force too. Is it possible to set up and IPS profile to block this from happening? Im having a random user login from two random IPs every 5 minutes. Most IPs come from china, but not all. Its a botnet knocking on my front door. What can i do to protect myself?
 
PD: reading some other posts, where just administrator and admin are the users being used. in my case administrator was used but not the only. mosly common username like "sales, marketing, john, etc".
post edited by tomasbond - 2021/08/22 14:34:25
#10
ianmclachlan
New Member
  • Total Posts : 14
  • Scores: 2
  • Reward points: 0
  • Joined: 2019/03/01 01:47:24
  • Status: offline
Re: SSL VPN 2021/08/23 02:33:41 (permalink)
0
These attacks seems to be increasing.  I'm currently geo-blocking by dropping traffic on the IPv4Policy by individual country.  However, it's quite time consuming as I have to lookup the IP's locations and add a block for that country.  Anyone found a way of blocking all countires apart from my own. 
 
@tomasbonf ... this will probably work in your case as well.
#11
nkasiou
New Member
  • Total Posts : 2
  • Scores: 2
  • Reward points: 0
  • Joined: 2021/08/23 03:19:28
  • Status: offline
Re: SSL VPN 2021/08/23 03:25:34 (permalink)
0
we are facing the same issue. 
We have FortiGate Firewalls installed around the world and all of them are targeted.
the brute force started in Aug18 the attacks are mostly IPs from China. 
the IP is always different and they target different usernames every 2 minutes in a rotation. 
 
we have tried to increase the block time for 2 unsuccessful logins but that does not trigger.  
 
Does anyone have a solution for this? as I can see the attack is increasing.
 
does anyone know if this attack only targets Fortigate firewalls?
#12
Ger
New Member
  • Total Posts : 7
  • Scores: 2
  • Reward points: 0
  • Joined: 2021/08/20 12:18:30
  • Status: offline
Re: SSL VPN 2021/08/23 06:33:32 (permalink)
0
ianmclachlan
These attacks seems to be increasing.  I'm currently geo-blocking by dropping traffic on the IPv4Policy by individual country.  However, it's quite time consuming as I have to lookup the IP's locations and add a block for that country.  Anyone found a way of blocking all countires apart from my own. 
 
@tomasbonf ... this will probably work in your case as well.




Hi.. I guess adding your country as an address object and then, using the a policy to just allow inbound connection from your country?
 
EDIT: Yes, I think that could be the way. I just check my fw inbound rules from ssl.vpn and I can add my country in "source" (First, I add my country as object) I will just wait for an "expert" second opinion before "commit" the change..
 
 
 
 
 
post edited by Ger - 2021/08/23 06:40:32
#13
rg2017
Bronze Member
  • Total Posts : 22
  • Scores: 2
  • Reward points: 0
  • Joined: 2017/08/02 07:28:21
  • Status: offline
Re: SSL VPN 2021/08/23 08:37:38 (permalink)
5 (1)
I've been seeing more attempts over the past few days. These connections are trying other user account names in addition to the admin and administrator seen before. I just changed the config to only allow connections from IPs in the US geographical location. This is in SSL-VPN Settings in the GUI.
 

Attached Image(s)

#14
badnerone
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2005/10/06 00:26:03
  • Status: offline
Re: SSL VPN 2021/08/23 09:16:02 (permalink)
0
Hi to all,
Same problem, appear no a brute force attack, but I suspect that attacks are attempts to discover and use some SSL VPN bugs... Here needs an Fortinet Experts answer.
 
Thanks
#15
rg2017
Bronze Member
  • Total Posts : 22
  • Scores: 2
  • Reward points: 0
  • Joined: 2017/08/02 07:28:21
  • Status: offline
Re: SSL VPN 2021/08/23 11:24:22 (permalink)
0
Does anyone know if it's possible to see a log of attempted connections now that I have the restricted hosts set to the US? I've looked and can't find any event logs that contain those attempts being blocked.
#16
Ger
New Member
  • Total Posts : 7
  • Scores: 2
  • Reward points: 0
  • Joined: 2021/08/20 12:18:30
  • Status: offline
Re: SSL VPN 2021/08/23 12:49:03 (permalink)
0
rg2017
Does anyone know if it's possible to see a log of attempted connections now that I have the restricted hosts set to the US? I've looked and can't find any event logs that contain those attempts being blocked.




I don't know if this is what you need, but I think you need to have enabled "event logging" in log settings.
Then, events. vpn events, "action" ssl-login-fail.  I have tons of them even with geolocation configured
 
#17
Ger
New Member
  • Total Posts : 7
  • Scores: 2
  • Reward points: 0
  • Joined: 2021/08/20 12:18:30
  • Status: offline
Re: SSL VPN 2021/08/23 13:03:18 (permalink)
5 (1)
rg2017
I've been seeing more attempts over the past few days. These connections are trying other user account names in addition to the admin and administrator seen before. I just changed the config to only allow connections from IPs in the US geographical location. This is in SSL-VPN Settings in the GUI.
 



THIS, thanks.
 
I just followed https://kb.fortinet.com/kb/documentLink.do?externalID=FD40500 but i still getting ssl logins failed. I don't know if the policy it's ok, basically all from the sd-wan to ssl.root deny, but still getting login attemps.
 
#18
nkasiou
New Member
  • Total Posts : 2
  • Scores: 2
  • Reward points: 0
  • Joined: 2021/08/23 03:19:28
  • Status: offline
Re: SSL VPN 2021/08/24 00:30:34 (permalink) ☄ Helpfulby rg2017 2021/08/24 10:06:43
5 (1)
Following up. 
 
We can see that the source IPs are Hacked devices from all over the world. 
if you add the IPs on the browser you can see that they are routers, hotspots, network devices  etc....
so they are redirecting their malicious requests through the hacked devices.
 
Most of these devices have the default admin password of the provider/brand. I was able to log in to multiple devices. 
 
the bad thing is that the hacked devices are too many so you cannot just block the IPs. 
 
Blocking the malicious IPs that are coming in with a script will not help because up until now the requests come from unique IPs.
#19
ianmclachlan
New Member
  • Total Posts : 14
  • Scores: 2
  • Reward points: 0
  • Joined: 2019/03/01 01:47:24
  • Status: offline
Re: SSL VPN 2021/08/24 01:55:08 (permalink)
5 (1)
Restricting Access in the SSL-VPN settings worked a treat.  Clearly some automated script searching the net for weak/default login creds.  Probably everyone affected uses 10443 as the VPN port and this might correspond to some other service/device that the script is looking or checking for. 
#20
Page: 12 > Showing page 1 of 2
Jump to:
© 2021 APG vNext Commercial Version 5.5