CISCO ASA 5505 : How to block a ip doing brute force attack on Remote Desktop ?

[chdalleux]

Hi all,

I have a fixed ip and I am under attack by a brute force / hammering on port 3389 for the Remote Desktop Connection.

I want the CISCO 5505 to detect the attack (for example if they try 5 connections in 3 minutes) and then to ban / shun the attacker ip for one day.

Is it possible ? How ?

Note : I don't want to change the 3389 port.

[Collin Clark]

You would need an IPS module to do that.

http://www.cisco.com/c/en/us/products/collateral/security/intrusion-prevention-system/product_bulletin_c25-528621.html