Find the failed-login source, understand the “too many bad login attempts” timer, safely unblock a user’s IP, and reduce repeated SSL VPN password guessing.
Open the full FortiGate protection guideRepeated FortiGate SSL VPN failed login attempts often come from automated password guessing, often against usernames that do not exist. First, confirm the source IPs and reasons in VPN Events. Then keep MFA and access restrictions in place. Finally, tune the per-IP attempt limit and block known sources before they reach the login page.
Test first: download the free 200-entry sample. No signup is required.
Start with the event record. The reason, remote IP, username, and action tell you whether this is a bad password, an unknown user, a mapping problem, or a source-IP block.
On FortiOS 7.2, 7.4 and 7.6, go to Log & Report > System Events, open the Logs tab (named Details on 7.2), select VPN Events, and filter for action ssl-login-fail. VPN Events appears when VPN is enabled under System > Feature Visibility.
On FortiOS 7.0, use Log & Report > Events and select VPN Events from the event-type list.
Fortinet documents a Dashboard > Top Failed Authentication monitor for a consolidated view of firewall and SSL VPN failures. Filter the login type for SSL-VPN when investigating the portal.
The following FortiOS CLI filter follows Fortinet’s documented event-log syntax:
execute log filter category event
execute log filter field subtype vpn
execute log filter field action ssl-login-fail
execute log displayThis is a constructed example, not a customer log. Fortinet documents log ID 0101039426 and action ssl-login-fail for an SSL VPN login failure.
logid="0101039426" type="event" subtype="vpn" level="alert"
logdesc="SSL VPN login fail" action="ssl-login-fail"
tunneltype="ssl-web" remip=192.0.2.44 user="example-user"
group="N/A" reason="sslvpn_login_permission_denied"
msg="SSL user failed to logged in"ssl-login-fail action can carry different reasons. A password-expired event, an unknown user, and a permission or group-matching error do not have the same fix.
FortiGate’s SSL VPN login limit is a temporary source-IP block. It is not a permanent user ban. On FortiOS 7.6.3 and later, Fortinet removed SSL VPN tunnel mode; only web mode, now called Agentless VPN, remains on some models, and FortiGate models with 2GB of RAM or less support neither mode.
Fortinet documents a default login-attempt-limit of 2 and a default login-block-time of 60 seconds. Two consecutive incorrect username and password combinations from the same source IP within 60 seconds block attempts from that IP for the next 60 seconds.
The user sees: “Too many bad login attempts. Please try again in a few minutes.” The block time also defines the window in which the failures are counted as consecutive. Setting either value to 0 disables the block.
FortiClient shows -455 with more than one login failure, so read the message, not just the number. With “Too many bad login attempts. Please try again in a few minutes. (-455)”, the source IP reached login-attempt-limit and is blocked for login-block-time. With “Permission denied. (-455)”, Fortinet’s troubleshooting tip shows a wrong password (sslvpn_login_permission_denied) or a local username typed in the wrong case (sslvpn_login_unknown_user).
The FortiGate VPN event log shows the reason and the source IP. Many failures from IPs your users don’t use point to password guessing, not a user problem.
The settings are under config vpn ssl settings. On FortiOS 7.2.6 and later, the CLI help shown in Fortinet’s SSL VPN blocklist tech tip lists 0 through 10 attempts (0 means no limit) and 0 through 86,400 seconds for the block time. Older CLI references list wider integer limits, so check set login-attempt-limit ? on your own firmware.
config vpn ssl settings
set login-attempt-limit 2
set login-block-time 60
endUse values that fit your users and authentication design. Do not set either value to zero unless you intend to turn this protection off.
The safest reset on older releases is to wait for login-block-time to expire. FortiOS 7.2.6 and later, 7.4.1 and later, and 7.6 provide commands to view and delete SSL VPN blocklist entries:
diagnose vpn ssl blocklist list
diagnose vpn ssl blocklist del 192.0.2.44Replace 192.0.2.44 with the verified public IPv4 address of the affected user. The Top Failed Authentication monitor can show the failures, but Fortinet documents the CLI as the way to remove the SSL VPN blocklist entry.
Two different controls can produce what looks like one lockout problem.
| Control | What is blocked | Where to check | How it clears |
|---|---|---|---|
| FortiGate SSL VPN login attempt limit | The remote source IP | diagnose vpn ssl blocklist list on supported releases |
Wait for login-block-time, or delete the verified IP on supported releases |
| FortiGate local-user password policy | Login for a local user whose password has expired (reason sslvpn_login_password_expired) |
VPN Events, reason field of log ID 0101039426 |
Renew or reset the password as the policy requires |
| LDAP, RADIUS, or Active Directory policy | The remote account at the authentication service | Remote authentication-server logs plus FortiGate VPN Events | Follow the identity provider’s unlock policy after stopping the bad attempts |
The FortiGate per-IP control does not prevent a remote identity system from counting failed passwords. That is why legitimate users can still be locked out when attackers submit their usernames. Fortinet documents SSL VPN realms as one way to avoid sending arbitrary login names to an LDAP or RADIUS server.
Do not weaken a real account-lockout policy just to quiet VPN noise. See account lockout prevention for the broader identity-side problem.
A per-IP limit works against repeated attempts from one address. Distributed password spraying can stay below that threshold by spreading attempts across addresses.
Use Fortinet’s free controls first:
The detailed FortiGate configuration is in How to Stop FortiGate SSL VPN Brute Force Attacks. For the attack pattern itself, see VPN password spraying.
FortiOS 7.2.4 and later supports an external IP threat-feed object in a local-in policy. Fortinet documents CLI configuration from 7.2.4 and GUI configuration from 7.6.0. FortiOS 7.0 does not support an external threat feed as the source of a local-in policy.
When SSL VPN listens directly on a WAN interface, a deny local-in policy can use the feed as its source. When SSL VPN listens on a loopback interface behind a VIP, use the firewall-policy design documented by Fortinet.
ThreatListPro is a plain-text feed with one IPv4 address or CIDR per line. Single addresses are written as /32. The customer URL format is https://api.threatlistpro.com/v1/YOUR_API_KEY/blocklist.txt. Set the FortiGate refresh to 60 minutes or its nearest available option.
It blocks known sources drawn from real attacks on live production Palo Alto GlobalProtect VPN portals in the US. The list covers 5.4M+ IPv4 addresses and is checked for new attackers every 6 hours. See the FortiGate feed instructions and FortiGate EDL limits.
sslvpn_login_permission_denied and Other Login ReasonsThe reason code narrows the investigation, but it does not always identify one single root cause.
sslvpn_login_permission_deniedFortinet documents this reason with several conditions: a wrong password, failed LDAP group matching, an intended user or group missing from the SSL VPN authentication and portal mapping, an applicable policy mismatch, or missing RADIUS address information in a user-group address-assignment design.
Check the exact username, the returned LDAP or RADIUS group, the configured FortiGate user group, the authentication and portal mapping, and the policy that references the SSL VPN group. Use authentication debug output when the event alone is not specific enough.
sslvpn_login_unknown_userFortinet shows this reason when the submitted identity does not match a known local user. Local FortiGate usernames are case-sensitive, so a capitalization mismatch can also appear as an unknown user.
sslvpn_login_password_expiredFortinet documents this reason in log ID 0101039426 when a local SSL VPN user’s password has expired. Treat it as an account-maintenance event, not proof of an attack, unless the surrounding source and timing show repeated hostile activity.
Use layered controls. Each one addresses a different part of the failed-login problem.
| Control | Repeated attempts from one IP | Distributed password spraying | Stolen correct password | Remote-account lockout pressure |
|---|---|---|---|---|
| FortiGate login attempt limit | Yes, temporarily | Limited | No | Partial |
| MFA | Does not remove attempts | Does not remove attempts | Helps prevent completed authentication | Not by itself |
| Host or geographic restriction | Yes, outside allowed sources | Yes, outside allowed sources | Only from disallowed sources | For rejected sources |
| Threat feed in a deny policy | For listed IPs | For listed IPs across the campaign | Only when the source is listed | For listed IPs blocked before login |
| Disable unused users and mappings | Removes unnecessary targets | Removes unnecessary targets | Prevents use of disabled access | Reduces exposed accounts |
| Current FortiOS and PSIRT remediation | Does not remove password attempts | Does not remove password attempts | Addresses applicable vulnerabilities | Not directly |
Repeated failures can indicate automated password guessing or password spraying, especially when the logs show unknown usernames or many remote IP addresses. Confirm the pattern in VPN Events, keep MFA enabled, restrict who can reach SSL VPN, and block known sources before they reach the login service.
By default, wait 60 seconds for the source-IP block to expire. On FortiOS 7.2.6 and later, 7.4.1 and later, and 7.6, list entries with diagnose vpn ssl blocklist list and remove one with diagnose vpn ssl blocklist del followed by its IPv4 address. Verify that the address belongs to the user first.
The default login-attempt-limit is 2 and the default login-block-time is 60 seconds. Two incorrect username and password combinations from the same source IP within 60 seconds cause FortiGate to block that IP for 60 seconds. Setting either value to 0 disables this block.
In current FortiOS releases, open Log & Report > System Events, select VPN Events, and filter for action ssl-login-fail. The failed SSL VPN event uses log ID 0101039426. You can also add the Dashboard > Top Failed Authentication monitor. FortiOS 7.0 places VPN Events under Log & Report > Events.
The built-in login-attempt-limit mechanism temporarily blocks the source IP, not the username. A separate LDAP, RADIUS, or Active Directory lockout policy can still lock a real remote account when bad passwords are sent to that authentication server. Review both the FortiGate blocklist and the remote authentication logs.
It is a reason code, not one unique diagnosis. Fortinet documents it with wrong passwords, failed LDAP group matching, missing or incorrect SSL VPN authentication and portal mappings, and some policy or RADIUS address-assignment problems. Check the username, group mapping, portal mapping, applicable policy, and authentication debug output.
ThreatListPro covers 5.4M+ IPv4 addresses and is checked for new attackers every 6 hours. Monthly is $9.99 with a 14-day free trial and no card needed. Yearly is $100. Enterprise is $49.99/month. Paid plans have a 14-day money-back guarantee.
Start a 14-day free trial Or test 200 entries first: free, no signupThreatListPro provides a standard IP blocklist feed compatible with firewalls that support external lists.
Continue with the full setup guide or investigate the authentication and list-capacity details.