Look up the exact FortiGate field, SSL VPN failure reason, or FortiClient error before changing authentication or firewall settings.
Open the log lookup tableRead the fields together. logid identifies the event type; action records the outcome; reason narrows the failure; remip is the remote address; user is the submitted identity; and tunneltype shows how FortiGate classified the connection stage. No single field proves an attack or gives a complete root cause.
Testing a block list? Download the free 200-entry sample. No signup is required.
Start with the exact value you found. The “does not prove” column prevents a single field from being treated as a diagnosis.
| Field or value | Plain meaning | What it does not prove | Next check | Fortinet source |
|---|---|---|---|---|
Threat ID 131072 (log viewer)craction=131072 (raw log) |
Fortinet documents 131072 as the threat-weight value for a blocked connection. In the documented case with no UTM profile, it appears when traffic is denied by firewall policy. | It is not, by itself, an IPS detection or proof that the endpoint is malicious. | Read action, policy ID, interfaces, source, destination, and port. Confirm whether that policy deny was expected. |
Threat 131072 in denied traffic |
logid="0101039426"action="ssl-login-fail" |
This is FortiGate’s SSL VPN login-failure event. The log-message reference names message ID 39426 “SSL VPN login fail.” | It does not say why authentication failed. Read reason and the surrounding authentication debug. |
Correlate reason, remip, user, time, group, and authentication backend. |
FortiOS 7.6.6 log-message reference |
msg="SSL user failed to logged in" |
This is the message text Fortinet shows with log ID 0101039426 and action ssl-login-fail. |
The wording does not identify a bad password, an unknown user, or an attack by itself. | Use the structured reason, user, and remip fields instead of diagnosing from the message text. |
Fortinet example of log ID 0101039426 |
reason="sslvpn_login_permission_denied" |
Authentication or authorization was denied. Fortinet documents causes including an incorrect local credential, a user/group mismatch, and a failed LDAP group match. | It does not identify one unique root cause, and it does not prove the password alone was wrong. | Check exact username case, the group returned by LDAP or RADIUS, SSL VPN authentication/portal mappings, and the group referenced by the policy. | Permission denied and failed group matching |
reason="sslvpn_login_unknown_user" |
FortiGate could not validate the submitted identity as an applicable user. Fortinet lists an unconfigured account, a typo or case mismatch, rule/interface mismatch, authentication timeout, and other configuration causes. | It does not prove deliberate username enumeration. A real user with incorrect case or a mapping problem can produce it. | Compare the submitted name with the configured account, including case. Then check realms, authentication rules, source interface, LDAP connectivity, and remote-authentication timing. | Fortinet unknown-user troubleshooting |
reason="sslvpn_login_password_expired" |
Fortinet documents this reason when a local SSL VPN user’s password has expired under a local-user password policy. | It does not, by itself, indicate hostile activity. | Verify the local account’s password policy and follow the approved password-change process. | SSL VPN with local-user password policy |
tunneltype="ssl-web" in a FortiClient failure |
Fortinet says a FortiClient tunnel-mode attempt first reaches the HTTPS URL, so a failed login can be recorded as ssl-web before a tunnel is established. |
It does not prove the user connected through the browser or that web mode is enabled. | Look for a later successful tunnel-up event with tunneltype="ssl-tunnel". On FortiOS 7.6.3 and later, SSL VPN tunnel mode is no longer available. |
Why FortiClient failures show ssl-web |
tunneltype="ssl-tunnel" |
Fortinet shows this value on the successful tunnel-up event (logid="0101039947", action="tunnel-up", “SSL tunnel established”) in versions that support SSL VPN tunnel mode. |
A failed event without this value does not prove the user intentionally selected web mode. | Check the event action and log description. For FortiOS 7.6.3 or later, use Fortinet’s SSL VPN-to-IPsec migration guidance. | Fortinet tunnel-up example; FortiOS 7.6.3 tunnel-mode change |
Permission denied. (-455) |
FortiClient shows this for several SSL VPN authentication or authorization failures. Fortinet documents it with a wrong password (logged as sslvpn_login_permission_denied), a local username whose case does not exactly match (logged as sslvpn_login_unknown_user), and a user who is not in the group set in SSL VPN Authentication/Portal Mapping. A separate “Host check requirement error (-455)” points to host-check settings. |
It is not a single-cause “wrong password” code. | Check the matching user/group, portal mapping, policy group, exact local-username case, and the corresponding FortiGate reason. |
FortiClient -455 and username case |
Credential or SSL VPN configuration is wrong (-7200) |
Fortinet associates this error with authentication or SSL VPN configuration problems. Its troubleshooting guidance includes checking credentials, two-factor authentication, group matching, and relevant debug output. | It does not distinguish a bad credential from the configuration, certificate, or MFA problems that can produce the same client message. | Recheck the credentials first. Then check two-factor authentication (including an expiring token), the user group in SSL VPN Authentication/Portal Mapping, and the SSL VPN and authentication debug output at the same timestamp. Fortinet notes that FortiGate may drop the connection without an error in the debug output. | FortiClient failures by negotiation stage |
-5029 |
Fortinet documents this at about 31% or 40% negotiation when the TLS version used by FortiGate is not enabled on the client. | It does not identify which side has the unsuitable TLS setting without further comparison. | Compare the TLS versions allowed by FortiGate and FortiClient. | FortiClient -5029 guidance |
-12“Unable to logon to server. Username or password might not be configured properly for this connection.” |
Fortinet documents this error when the FortiClient connection is not using the intended custom port, and also lists authentication, compatibility, and connectivity as possible causes. | It does not prove the username or password is wrong. | If the gateway does not use port 443, confirm that Customize port is selected and the correct port is saved. Then test reachability and authentication. | FortiClient -12 troubleshooting |
-14 near 80% |
Fortinet says this can be caused by a user/group mismatch between SSL VPN authentication rules and the firewall policy. | The percentage and code do not prove that this is the only possible configuration fault. | Compare the user group in the authentication rule, firewall policy, and portal mapping. Check the configured realm as well. | FortiClient -14 guidance |
FortiGate shows “Too many bad login attempts. Please try again in a few minutes.” when its built-in SSL VPN limit blocks a source IP. The limit tracks failed attempts from that IP and temporarily places the address in the SSL VPN blocklist. Fortinet’s lockout article gives the message text but no error code. FortiClient also shows -455 for ordinary permission failures (see the lookup table), so check the FortiGate log before assuming a lockout.
Fortinet documents a default login-attempt-limit of 2 and a default login-block-time of 60 seconds. Two consecutive incorrect username/password combinations from the same IP within 60 seconds cause a 60-second block.
The block time also defines the window in which the failed attempts are considered consecutive. Setting either value to 0 disables this blocking mechanism.
config vpn ssl settings
set login-attempt-limit 2
set login-block-time 60
endDo not raise or disable these values merely to clear one user’s error. First confirm that the source address belongs to the affected user.
The normal reset is to wait for login-block-time to expire. Fortinet also documents commands to inspect and remove a source-IP entry in FortiOS 7.2.6 and later, 7.4.1 and later, and 7.6.x:
diagnose vpn ssl blocklist list
diagnose vpn ssl blocklist del 203.0.113.25Replace the example address with the verified public IPv4 address of the user. Fortinet also documents the Dashboard > Top Failed Authentication monitor for viewing failed attempts; removal is performed in the CLI.
A failed login is an event, not an attribution. Look for repetition and distribution before deciding what the pattern means.
sslvpn_login_unknown_user events: may indicate automated attempts using guessed names. The same reason can also result from case, realm, interface, LDAP, RADIUS, or rule problems.For response and hardening steps, see how to stop repeated FortiGate SSL VPN failed logins. For distributed credential attacks, see VPN password spraying explained.
A block list is useful after you have enabled Fortinet’s own authentication, access-control, and login-limit protections.
ThreatListPro provides a plain-text IPv4 feed for compatible firewall policies. It covers 5.4M+ IPv4 addresses. Entries come from real attacks on live production Palo Alto GlobalProtect VPN portals in the US, and the list is checked for new attackers every 6 hours.
The customer feed uses one IPv4 address or CIDR per line, with single addresses written as /32. Configure the FortiGate refresh for 60 minutes or its nearest available option.
Use the FortiGate protection guide for the supported setup. This reference page intentionally does not repeat those policy steps.
A new IP’s first attempt still arrives. ThreatListPro is IPv4 only, and it does not stop every brute-force or password-spraying attempt. CIDR ranges include addresses that did not each attack, so check your users’ source IPs first and allow-list trusted networks where needed.
A list also does not replace MFA, secure group and portal mappings, access restrictions, current FortiOS releases, authentication monitoring, or incident response.
Fortinet documents 131072 as the threat-weight value for a blocked connection. In its no-UTM example, the firewall denied the traffic through policy. It is not, by itself, an IPS detection. Check the action, policy ID, interfaces, source, destination, and port before changing the policy.
Log ID 0101039426 is the SSL VPN login-failure event. Its action is ssl-login-fail. Read the reason, remote IP, submitted username, group, time, and tunnel type together. The event confirms a failed login but does not establish whether the cause was an attack, a bad credential, or a configuration problem.
FortiGate could not validate the submitted identity as an applicable user. Fortinet lists several possible causes, including an account that is not configured, incorrect username case, a realm or authentication-rule mismatch, authentication-server problems, and timeouts. It is not automatic proof of username enumeration.
It is a broad authentication or authorization failure, not one unique diagnosis. Fortinet documents it with incorrect local credentials, failed LDAP group matching, and user/group mapping problems. Check username case, returned directory groups, SSL VPN authentication and portal mappings, the policy group, and authentication debug output.
By default, wait 60 seconds for the source-IP block to expire. On FortiOS 7.2.6 and later, 7.4.1 and later, and 7.6.x, list entries with diagnose vpn ssl blocklist list and remove a verified address with diagnose vpn ssl blocklist del <address>.
Fortinet says a FortiClient tunnel-mode connection first reaches the HTTPS URL. Until login succeeds and the tunnel is established, FortiGate can record the failed attempt as ssl-web. That field alone does not prove the user connected through a browser. SSL VPN tunnel mode is unavailable starting with FortiOS 7.6.3.
ThreatListPro covers 5.4M+ IPv4 addresses and is checked for new attackers every 6 hours. Monthly is $9.99 with a 14-day free trial and no card needed. Yearly is $100. Enterprise is $49.99/month. Paid plans have a 14-day money-back guarantee.
Start a 14-day free trial Or test 200 entries first: free, no signupThreatListPro uses a plain-text feed for firewalls that support external IPv4 address lists.
Continue with the response, hardening, and feed-configuration guides.