cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
233
Views
0
Helpful
3
Replies
Highlighted

Support for account lockout?

Hi community,

Does Cisco ACI support account lockout upon authentication failure (like for 5 failed attempts within a certain amount of time)? Local users, and probably also needed for remote users.

Thanks heaps.

Everyone's tags (5)
2 ACCEPTED SOLUTIONS

Accepted Solutions
Highlighted
Enthusiast

Re: Support for account lockout?

Hi @tuanquangnguyen 

 

This is a feature of ACI MSO (see release notes below )

■      When upgrading from a release prior to Release 2.2(1), a GUI lockout timer for repeated failed login attempts is automatically enabled by default and is set to 5 login attempts before a lockout with the lockout duration incremented exponentially every additional failed attempt.

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/aci_multi-site/sw/2x/release-notes/Cisco-ACI-Multi-Site-Release-Notes-223.html

 

However, I've not seen it move down into the APIC itself.  I can confirm it is not available in version 4.1(1k) or 4.2(3q) and have not found anything in the release notes to suggest its a feature (yet) so for now it does not look like you can rely on getting this capability from the APIC itself.  You would likely need to enable authentication to another source that does support this capability.

 

View solution in original post

Highlighted
Rising star

Re: Support for account lockout?

Hi @tuanquangnguyen 

The feature is fresh and new, now available in ACI 4.2.4.

You can block a user from being able to log in after the user fails a configured number of login attempts. You can specify how many failed login attempts the user can have within a specific time period. If the user fails to log in too many times, then that user becomes unable to log in for a specified period of time.

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/release-notes/cisco-apic-release-notes-424.html 

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/security/b-Cisco-APIC-Security-Configuration-Guide-421/b-Cisco-APIC-Security-Configuration-Guide-421_chapter_011.html#Cisco_Concept.dita_5c10e028-7d03-4b96-94c9-4737f8e5206d 

 

Cheers,

Sergiu

View solution in original post

3 REPLIES 3
Highlighted
Enthusiast

Re: Support for account lockout?

Hi @tuanquangnguyen 

 

This is a feature of ACI MSO (see release notes below )

■      When upgrading from a release prior to Release 2.2(1), a GUI lockout timer for repeated failed login attempts is automatically enabled by default and is set to 5 login attempts before a lockout with the lockout duration incremented exponentially every additional failed attempt.

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/aci_multi-site/sw/2x/release-notes/Cisco-ACI-Multi-Site-Release-Notes-223.html

 

However, I've not seen it move down into the APIC itself.  I can confirm it is not available in version 4.1(1k) or 4.2(3q) and have not found anything in the release notes to suggest its a feature (yet) so for now it does not look like you can rely on getting this capability from the APIC itself.  You would likely need to enable authentication to another source that does support this capability.

 

View solution in original post

Highlighted

Re: Support for account lockout?

Thanks Claudia for the explanation.
Highlighted
Rising star

Re: Support for account lockout?

Hi @tuanquangnguyen 

The feature is fresh and new, now available in ACI 4.2.4.

You can block a user from being able to log in after the user fails a configured number of login attempts. You can specify how many failed login attempts the user can have within a specific time period. If the user fails to log in too many times, then that user becomes unable to log in for a specified period of time.

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/release-notes/cisco-apic-release-notes-424.html 

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/security/b-Cisco-APIC-Security-Configuration-Guide-421/b-Cisco-APIC-Security-Configuration-Guide-421_chapter_011.html#Cisco_Concept.dita_5c10e028-7d03-4b96-94c9-4737f8e5206d 

 

Cheers,

Sergiu

View solution in original post