topic Re: Query for Cisco FTD Brute Force Attack in Network Security

Query for Cisco FTD Brute Force Attack

pinjar84062 — Fri, 29 May 2020 15:48:31 GMT

Hellow Everyone,

We have a query about Brute force attack. Can Cisco FTD(2110) prevent brute force attack through IPS? I know that, IPS has a brute force attack signature. When i have enabled this signature it do not drops any brute force attack packet. So please tell me how can we prevent this attack or share procedure.
Thanks for advance.

Regards,

Samiul Islam

Re: Query for Cisco FTD Brute Force Attack

Marvin Rhoads — Sat, 30 May 2020 14:29:46 GMT

"Brute Force Attack" is not a precise term. What exactly are you trying to protect against?

Re: Query for Cisco FTD Brute Force Attack

pinjar84062 — Sat, 30 May 2020 15:11:12 GMT

Hello Sir,

Thanks for your Reply.

I want to prevent ssh attack by IPS Rules.
For example IPS Signature :
source ip: any
destination ip : Our organization Server IP
Source Port: any
Destination Port: SSH/22
Number of SSH TRY for Server: 10
Time Duration: 60 Second
Action: Block and Generate Events.

Is that possible through IPS? Is possible, please share the procedure.

Re: Query for Cisco FTD Brute Force Attack

Marvin Rhoads — Sun, 31 May 2020 11:26:44 GMT

It's done via the Network Analysis Policy.

See the following for configuration instructions:

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/detecting_specific_threats.html#ID-2236-00000386

Re: Query for Cisco FTD Brute Force Attack

buffkata — Thu, 27 Jul 2023 20:05:34 GMT

Marvin, Is there are newer guide - for FMC version 7.2.4 and later. Seams that the guide you post is for much older version and not able to find the settings ?