topic Re: Look solution to mitigate VPN bruteforce attack in Network Security

Look solution to mitigate VPN bruteforce attack

Da ICS16 — Fri, 25 Apr 2025 10:06:51 GMT

Dear Community,

We explore the solution to mitigate VPN brute force attack in Cisco FTD.

AD users always locked out when under targeting potential VPN brute force attacks so it leads to AD account locked out and impact to legit users (internal user).

Flow: FTD -> ISE.

ISE has connectivity to AD and 2FA (OTP). On ISE get source form FTD and on ISE Policy Set (Authentication methods: PAP/ASCII or MSCHAPv2, NAS-PORT-TYPE: Virtual).

- We enabled "AD account locked out policies , eg: 5 failed attempt" server.

- ISE features tested: 'Reject RADIUS requests from clients with repeated failures', 'Prevent Active Directory User Lockout' but cannot blocked AD user on ISE.

We user ISE 3.1, Cisco Secure Client VPN agent 5.x

Could you share commend / good practice to prevent / mitigate this kind of vpn brute force attacks? To ensure no AD locked on target users.

Well appreciated for you supporting.

Best Regards,

Re: Look solution to mitigate VPN bruteforce attack

Rob Ingram — Mon, 28 Apr 2025 07:14:17 GMT

@Da ICS16 you can enable threat detection capability, this may require a patch/upgrade as this is a relatively new feature.

Once enabled, the FTD automatically shuns the host (IP address) that exceeds the configured thresholds, to prevent further attempts until you manually remove the shun of the IP address.

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221806-password-spray-attacks-impacting-custome.html

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/222383-configure-threat-detection-for-remote-ac.html

Re: Look solution to mitigate VPN bruteforce attack

Da ICS16 — Mon, 28 Apr 2025 01:47:35 GMT

Hello @Rob Ingram

Thanks for your commend and supporting.

To enable threat detection capability, does it can mitigate this kind of attack even the attacker's known AD User?

Thanks.

Re: Look solution to mitigate VPN bruteforce attack

Rob Ingram — Mon, 28 Apr 2025 04:31:58 GMT

@Da ICS16 yes

Re: Look solution to mitigate VPN bruteforce attack

Da ICS16 — Mon, 28 Apr 2025 07:07:53 GMT

Hello @Rob Ingram

For we ever did even the configured threshold, tuning certificate but no luck to prevent AD user locked out.

Seem it is not the fixed solution.

Re: Look solution to mitigate VPN bruteforce attack

Rob Ingram — Mon, 28 Apr 2025 07:13:52 GMT

@Da ICS16 what software version are you running? Have you confirmed that threat detection is working after you configured it, run - "show threat-detection service" and "show shun"