I've noticed in my System logs that there are SSH2 brute force attempts against our firewall.
Unfortunately nothing is listed in the Traffic or Threat logs under the Monitor tab to indicate from which zone the traffic is originating from.
Why would this be the case and how can I enable logging for this in the Traffic\Threat logs to determine from which zones the traffic is originating from?
Solved! Go to Solution.
isn't there a 'from: <IP>' included in the log?
a good start would be to check incoming ssh sessions from the internet (as this is usually the most likely source)
if these are hitting your management, i would recommend removing access to your management interface from outside or at least configuring some security policy to only allow trusted sources to connect
Yes there are IP's included in the System logs. I have checked my traffic logs, and the only SSH sessions are those internally outbound that we have explicitly allowed. We have recently further hardended all our public IP's, so no SSH sessions should be hitting my firewall.
How am I able to determine whether the SSH logon attempts is hitting my management IP?
If there is an IP, that should probably give you an indication where the connection is coming from, but if there's nothing in your traffic logs they may be hitting a management profile on a dataplane interface (rather than the management interface):
I see we previously configured 3 different management profiles.
Am I correct in saying that if there is no IPs listed in the Permitted IP Addresses, this will allow the selected services from any source IP?
Thank you Reaper, I have adjusted our management profiles and will be monitoring the system logs over the next few days. Appreciate the assistance!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!