Support for account lockout?

[tuanquangnguyen]

Hi community,

Does Cisco ACI support account lockout upon authentication failure (like for 5 failed attempts within a certain amount of time)? Local users, and probably also needed for remote users.

Thanks heaps.

[Claudia de Luna · Accepted solution]

Hi @tuanquangnguyen 

This is a feature of ACI MSO (see release notes below )

■      When upgrading from a release prior to Release 2.2(1), a GUI lockout timer for repeated failed login attempts is automatically enabled by default and is set to 5 login attempts before a lockout with the lockout duration incremented exponentially every additional failed attempt.

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/aci_multi-site/sw/2x/release-notes/Cisco-ACI-Multi-Site-Release-Notes-223.html

However, I've not seen it move down into the APIC itself.  I can confirm it is not available in version 4.1(1k) or 4.2(3q) and have not found anything in the release notes to suggest its a feature (yet) so for now it does not look like you can rely on getting this capability from the APIC itself.  You would likely need to enable authentication to another source that does support this capability.

[tuanquangnguyen]

Thanks Claudia for the explanation.

[Sergiu.Daniluk · Accepted solution]

Hi @tuanquangnguyen 

The feature is fresh and new, now available in ACI 4.2.4.

You can block a user from being able to log in after the user fails a configured number of login attempts. You can specify how many failed login attempts the user can have within a specific time period. If the user fails to log in too many times, then that user becomes unable to log in for a specified period of time.

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/release-notes/cisco-apic-release-notes-424.html 

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/security/b-Cisco-APIC-Security-Configuration-Guide-421/b-Cisco-APIC-Security-Configuration-Guide-421_chapter_011.html#Cisco_Concept.dita_5c10e028-7d03-4b96-94c9-4737f8e5206d 

Cheers,

Sergiu