LogID 0100022922: Admin Web GUI Login Lockout due to Automated Probing
Exposing HTTPS management to the Internet allows automated credential stuffing scanners to exhaust the FortiOS administrator lockout threshold, causing legitimate network engineers to be locked out of the GUI across all interfaces.
Technical Root Cause Analysis
When administrators enable administrative HTTPS access on external WAN interfaces (via set allowaccess https under config system interface) without restricting source IPs through set trusthost, the FortiGate management portal becomes visible to public Internet port scanners and automated dictionary bots.
By default in FortiOS, the system enforces brute-force protection using admin-lockout-threshold (default 3 failed attempts) and admin-lockout-duration (default 60 seconds). Because FortiOS tracks failed attempts globally by administrator username rather than by client source IP, an external attacker targeting the default admin username triggers a system-wide lockout flag. Consequently, when an internal administrator on a corporate management subnet attempts to log in, the httpsd daemon rejects the authentication request immediately, presenting the message: "Your account is locked out because of too many failed login attempts."
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Configuration | Mitigated Version / Feature | Recommended Action |
|---|---|---|---|
| FortiOS 7.0 | Global username lockout enabled | Local-in policy mitigation | Apply trusted hosts + local-in policy |
| FortiOS 7.2 | Global username lockout enabled | Local-in policy mitigation | Disable public WAN allowaccess https |
| FortiOS 7.4 | Global username lockout enabled | Local-in policy mitigation | Configure dedicated management VDOM |
| FortiOS 7.6 | Default global behavior | 7.6.0+ (Per-IP lockout option) | Enable source-IP based rate limiting |
Platform Impact: Affects all FortiGate physical appliances and FortiGate-VM instances with administrative HTTPS/SSH management enabled on WAN-facing interfaces without strict access control lists.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these commands to search recent system event logs for LogID 0100022922 and check the active administrator lockout table:
Diagnostic Commands
# 1. Filter system event logs for failed admin login attempts
execute log filter category 1
execute log filter field logid 0100022922
execute log display
# 2. Inspect active locked administrator accounts and expiration timers
diagnose sys admin-lockout list
# 3. Verify current administrative lockout settings under system global
show system global | grep -i lockoutRemediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the Ferrite interactive platform:
Frequently Asked Questions
Yes. If you have serial console access or an unlocked admin account, run diagnose sys admin-lockout clear to immediately remove all active lockout restrictions.
Changing the port from 443 to a custom port offers minimal protection against full-port bot scanners. The only guaranteed fix is applying set trusthost on administrator accounts and deploying local-in policies.
An interface with allowaccess https permits all source IPs to establish TLS handshakes with httpsd. A local-in policy drops unauthorized packets at the kernel/ASIC boundary, preventing httpsd from ever processing login attempts.