topic Re: What is object auth_vpn? in General Topics

What is object auth_vpn?

qmso475 — Fri, 22 Sep 2023 06:44:55 GMT

Set up email alert. Login When login fails.

A related email has arrived.

I looked at the logs, but I can't find auth_vpn.

What is object AUTH_VPN?

Re: What is object auth_vpn?

reaper — Fri, 22 Sep 2023 08:51:48 GMT

take a look at the authentication logs for a user 'admin' trying to log in to GlobalProtect or the GP portal

Re: What is object auth_vpn?

qmso475 — Fri, 22 Sep 2023 08:58:25 GMT

@reaper

No GlobalProtect settings exist on device.

Re: What is object auth_vpn?

reaper — Wed, 27 Sep 2023 09:26:33 GMT

ok. there is an authentication profile called AUTH_VPN, check where it is applied (then most likely in the admin authentication) someone is knocking on your mgmt interface or a mgmt profile attached to a dataplane interface, trying to get in using admin

might be legitimate, but check if your mgmt interfaces are properly protected so only identified sources (userid, jumphost IP addresses, ACL on the mgmt interface etc. ) are allowed to connect