cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

556
Views
0
Helpful
3
Replies
tuanquangnguyen
Beginner

Support for account lockout?

Hi community,

Does Cisco ACI support account lockout upon authentication failure (like for 5 failed attempts within a certain amount of time)? Local users, and probably also needed for remote users.

Thanks heaps.

2 ACCEPTED SOLUTIONS

Accepted Solutions
Claudia de Luna
Enthusiast

Hi @tuanquangnguyen 

 

This is a feature of ACI MSO (see release notes below )

■      When upgrading from a release prior to Release 2.2(1), a GUI lockout timer for repeated failed login attempts is automatically enabled by default and is set to 5 login attempts before a lockout with the lockout duration incremented exponentially every additional failed attempt.

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/aci_multi-site/sw/2x/release-notes/Cisco-ACI-Multi-Site-Release-Notes-223.html

 

However, I've not seen it move down into the APIC itself.  I can confirm it is not available in version 4.1(1k) or 4.2(3q) and have not found anything in the release notes to suggest its a feature (yet) so for now it does not look like you can rely on getting this capability from the APIC itself.  You would likely need to enable authentication to another source that does support this capability.

 

View solution in original post

Sergiu.Daniluk
VIP Engager

Hi @tuanquangnguyen 

The feature is fresh and new, now available in ACI 4.2.4.

You can block a user from being able to log in after the user fails a configured number of login attempts. You can specify how many failed login attempts the user can have within a specific time period. If the user fails to log in too many times, then that user becomes unable to log in for a specified period of time.

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/release-notes/cisco-apic-release-notes-424.html 

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/security/b-Cisco-APIC-Security-Configuration-Guide-421/b-Cisco-APIC-Security-Configuration-Guide-421_chapter_011.html#Cisco_Concept.dita_5c10e028-7d03-4b96-94c9-4737f8e5206d 

 

Cheers,

Sergiu

View solution in original post

3 REPLIES 3
Claudia de Luna
Enthusiast

Hi @tuanquangnguyen 

 

This is a feature of ACI MSO (see release notes below )

■      When upgrading from a release prior to Release 2.2(1), a GUI lockout timer for repeated failed login attempts is automatically enabled by default and is set to 5 login attempts before a lockout with the lockout duration incremented exponentially every additional failed attempt.

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/aci_multi-site/sw/2x/release-notes/Cisco-ACI-Multi-Site-Release-Notes-223.html

 

However, I've not seen it move down into the APIC itself.  I can confirm it is not available in version 4.1(1k) or 4.2(3q) and have not found anything in the release notes to suggest its a feature (yet) so for now it does not look like you can rely on getting this capability from the APIC itself.  You would likely need to enable authentication to another source that does support this capability.

 

View solution in original post

Thanks Claudia for the explanation.
Sergiu.Daniluk
VIP Engager

Hi @tuanquangnguyen 

The feature is fresh and new, now available in ACI 4.2.4.

You can block a user from being able to log in after the user fails a configured number of login attempts. You can specify how many failed login attempts the user can have within a specific time period. If the user fails to log in too many times, then that user becomes unable to log in for a specified period of time.

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/release-notes/cisco-apic-release-notes-424.html 

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/security/b-Cisco-APIC-Security-Configuration-Guide-421/b-Cisco-APIC-Security-Configuration-Guide-421_chapter_011.html#Cisco_Concept.dita_5c10e028-7d03-4b96-94c9-4737f8e5206d 

 

Cheers,

Sergiu

View solution in original post

Content for Community-Ad