Technical Tip: Block SSL VPN failed logins with an automation stitch

salmas · ‎12-01-2023

Description

This article describes how to make an automation stitch for failed SSL VPN logins to block the remote IP addresses.

Scope

FortiGate.

Solution

Create an address group: To do this in the GUI: Navigate to Policy & Objects -> Addresses -> Create New -> Address Group -> Name: VPN_Failed_Login -> Ok.

To do this in the CLI:

config firewall addrgrp

edit VPN_Failed_Login

end

Create an automation stitch: Navigate to Security Fabric -> Automation -> Create New -> supply the name 'SSL_VPN_Login_Block'. Select Add Trigger -> Create -> FortiOS Event Log -> supply the name 'SSL_Login_Fail' -> open the FortiOS Event Log: Search and add 'SSL VPN login fail' -> select Ok -> select Apply.

Select Add Action -> Create -> CLI Script -> Supply the name 'BAN-SSLVPN-IP' -> Enter the script below -> select Ok -> select Apply -> select Ok.

config firewall address

edit %%log.remip%%

set color 6

set subnet %%log.remip%%/32

end

config firewall addrgrp

edit VPN_Failed_Login

append member %%log.remip%%

end

When a user has multiple VDOMs, the script must begin by specifying the same VDOM where the 'address group' object has been created:

config vdom

edit <vdom>

config firewall address

edit %%log.remip%%

set color 6

set subnet %%log.remip%%/32

end

config firewall addrgrp

edit VPN_Failed_Login

append member %%log.remip%%

end

A complete stitch will look like this:

Create a local policy:

config firewall local-in-policy

edit 1

set intf <SSL VPN Listening interface> <----- The source-interface under SSL VPN settings.
set srcaddr "VPN_Failed_Login"
set srcaddr-negate disable
set dstaddr "all"
set dstaddr-negate disable
set action deny
set service "ALL"
set service-negate disable
set schedule "always"
set status enable

The result:

When the VPN login fails, the trigger will be generated and an address object will be created for the remote IP the failed attempt came from.
After, the address object will be added to the address object group 'VPN_Failed_Login', which is mentioned in the local policy.
The local police will block anything coming from that remote IP.

Note:

This will block legitimate users as well if the login attempt fails. It will be necessary to manually remove each user's public IP from this address object to allow them to connect to the VPN again.