cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

2449
Views
2
Helpful
3
Replies
lvanwaye
Cisco Employee

Brute-force attack (auto login)

Hi,

How does ISE handle brute-force attacks ?

Cheers,

Lennert

1 ACCEPTED SOLUTION

Accepted Solutions
howon
Cisco Employee

Lennert,

For repeated 802.1X failures, ISE features anomalous client detection where admin can deny access from the endpoint for predetermined period (Default 1 hour). There are settings on the NADs, that also addresses such behavior from the client devices. Cisco WLC has client exclusion policies and Cisco IOS switches can leverage 802.1X settings to rate-limit authentication requests. Also the identity database such as AD can be configured to disable accounts after X number of unsuccessful authentication attempts.

Hosuk

View solution in original post

3 REPLIES 3
howon
Cisco Employee

Lennert,

For repeated 802.1X failures, ISE features anomalous client detection where admin can deny access from the endpoint for predetermined period (Default 1 hour). There are settings on the NADs, that also addresses such behavior from the client devices. Cisco WLC has client exclusion policies and Cisco IOS switches can leverage 802.1X settings to rate-limit authentication requests. Also the identity database such as AD can be configured to disable accounts after X number of unsuccessful authentication attempts.

Hosuk

View solution in original post

 

 
Content for Community-Ad