Information
Failed login attempts can indicate malicious attempts to gain access to your network. To prevent this security risk, FortiGate is preconfigured to limit the number of failed administrator login attempts. After the maximum number of failed login attempts is reached, access to the account is blocked for the configured lockout period.
Rationale:
When you login and fail to enter the correct password you could be a valid user, or a hacker attempting to gain access. For this reason, best practices dictate to limit the number of failed attempts to login before a lockout period where you cannot login for a certain period of time. lockout period will minimize the hacker attempts to gain access to firewall.
Impact:
Attackers will keep attempting to access the device through brute force attacks without any interruption which may lead to a successful login.
Solution
To configure the lockout options, from CLI:
config system global
set admin-lockout-threshold 3
set admin-lockout-duration 60
end
Default Value:
By default, the number of password retry attempts is set to three, allowing the administrator a maximum of three attempts at logging in to their account before they are locked out for a set amount of time (by default, 60 seconds).
To configure the lockout options, from CLI:
config system global
set admin-lockout-threshold 3
set admin-lockout-duration 60
end