Brute-force attack (auto login)

[lvanwaye]

Hi,

How does ISE handle brute-force attacks ?

Cheers,

Lennert

[howon · Accepted solution]

Lennert,

For repeated 802.1X failures, ISE features anomalous client detection where admin can deny access from the endpoint for predetermined period (Default 1 hour). There are settings on the NADs, that also addresses such behavior from the client devices. Cisco WLC has client exclusion policies and Cisco IOS switches can leverage 802.1X settings to rate-limit authentication requests. Also the identity database such as AD can be configured to disable accounts after X number of unsuccessful authentication attempts.

Hosuk

[axeleratorcisco]

Is this feature also applicable to Device Administration via Tacacs+, with an AD joined domain which contains the accounts of the ISE administrators?

[Rob Ingram]

@axeleratorcisco for blocking brute force attacks against a switch/router for device administration, you can control this from the switch/router using the command "login block-for X attempts X within X".

[axeleratorcisco]

Thanks Rob!

So on ISE there is no specific functionality for this? (Akin to anomolous client detection for 802.1x)

And thus no possibility of "quarantaining" the offending host via a function of ISE?