topic Re: Securing Wireless LAN Controllers against management credential brute force attacks in Wireless

Securing Wireless LAN Controllers against management credential brute force attacks

shammock — Mon, 05 Jul 2021 19:27:55 GMT

What is the recommended way to secure WLCs against management brute force attacks from the same source MAC or IP address please? Need an autonomous way to recognize multiple failed attempts from a bad actor who moves to another login when an account locks & just continues to hammer away with credential brute force attack over SSH / WebGUI. Bad actor should be blocked without manual intervention.

Thanks in advance,

Sam

Re: Securing Wireless LAN Controllers against management credential brute force attacks

Leo Laohoo — Tue, 01 Sep 2020 18:59:34 GMT

From the same source and MAC address? Block the MAC address from joining the wireless network in the first place.

Re: Securing Wireless LAN Controllers against management credential brute force attacks

shammock — Thu, 03 Sep 2020 14:41:59 GMT

I'll rephrase the question...

What is the recommended way to secure WLCs against SSH brute force attacks by blocking the bad actor's source address please? It's not enough that an account is locked out after x number of failed login attempts. We need to also block/blacklist any bad actor's source address dynamically & autonomously after x number of failed login attempts.

TIA,

Sam

Re: Securing Wireless LAN Controllers against management credential brute force attacks

YanBedia49446 — Thu, 03 Sep 2020 16:02:44 GMT

Hi Sam,

What is your network architecture?Do you have firewall?

Are you getting traps to your mail when someone blocked?

Yan Bedia

Re: Securing Wireless LAN Controllers against management credential brute force attacks

patoberli — Mon, 07 Sep 2020 15:37:16 GMT

There isn't much built in for that. The primary way is to limit the SSH access to the IP addresses of the managing computers and block all others.

The WLC will generate an snmp trap for every failed attempt (if I'm not mistaken) which you could process in your monitoring system.