ASA IPsec remote access VPN - limit number of auth retries

NazgulNr5 — Fri, 21 Feb 2020 17:46:51 GMT

Is there a way to limit the number of retries a VPN user has to authenticate? I found the aaa local authentication attempts max-fail command but our ra VPN uses certificates for authetication so I am not sure if the max-fail command would work.

Re: ASA IPsec remote access VPN - limit number of auth retries

Sheraz.Salim — Sat, 21 Dec 2019 13:15:11 GMT

for the ASA vpn configuration if custom configuration is not define then it always go and match the default configuraton.

show run all tunnel-group

tunnel-group DefaultRAGroup type remote-access
tunnel-group DefaultRAGroup general-attributes
no address-pool
no ipv6-address-pool
authentication-server-group LOCAL
secondary-authentication-server-group none
no accounting-server-group
default-group-policy DfltGrpPolicy
no dhcp-server
no strip-realm
no nat-assigned-to-public-ip
no scep-enrollment enable
no password-management
no strip-group
no authorization-required
username-from-certificate CN OU
secondary-username-from-certificate CN OU
authentication-attr-from-server primary
authenticated-session-username primary

I think you doing a local authentication if you have ISE servers you can define your attributes and push it from there.

topic Re: ASA IPsec remote access VPN - limit number of auth retries in Network Security

ASA IPsec remote access VPN - limit number of auth retries

Re: ASA IPsec remote access VPN - limit number of auth retries