topic Re: Brute-force attack (auto login) in Network Access Control

Brute-force attack (auto login)

lvanwaye — Mon, 04 Apr 2016 07:12:14 GMT

Hi,

How does ISE handle brute-force attacks ?

Cheers,

Lennert

Re: Brute-force attack (auto login)

howon — Mon, 04 Apr 2016 14:07:51 GMT

Lennert,

For repeated 802.1X failures, ISE features anomalous client detection where admin can deny access from the endpoint for predetermined period (Default 1 hour). There are settings on the NADs, that also addresses such behavior from the client devices. Cisco WLC has client exclusion policies and Cisco IOS switches can leverage 802.1X settings to rate-limit authentication requests. Also the identity database such as AD can be configured to disable accounts after X number of unsuccessful authentication attempts.

Hosuk

Re: Brute-force attack (auto login)

v_cheriyan@qp.com.qa — Sun, 09 Aug 2020 05:00:18 GMT

Re: Brute-force attack (auto login)

v_cheriyan@qp.com.qa — Sun, 09 Aug 2020 04:57:48 GMT

Re: Brute-force attack (auto login)

axeleratorcisco — Mon, 12 Dec 2022 16:55:29 GMT

Is this feature also applicable to Device Administration via Tacacs+, with an AD joined domain which contains the accounts of the ISE administrators?

Re: Brute-force attack (auto login)

Rob Ingram — Mon, 12 Dec 2022 17:23:08 GMT

@axeleratorcisco for blocking brute force attacks against a switch/router for device administration, you can control this from the switch/router using the command "login block-for X attempts X within X".

Re: Brute-force attack (auto login)

axeleratorcisco — Tue, 13 Dec 2022 07:38:37 GMT

Thanks Rob!

So on ISE there is no specific functionality for this? (Akin to anomolous client detection for 802.1x)

And thus no possibility of "quarantaining" the offending host via a function of ISE?