Cisco ASA IPS vs Bruteforce

[kostyacroc]

Who can help me, I need device that will block bruteforce attack to our webmail servers, 5 wrong password input = block for 10 min, for example.

Can I use for this Cisco ASA IPS?

[Dustin Ralich]

Depending on how your specific webmail server works, perhaps you could use/tune:

• SIG 6256.0 (HTTP Authorization Failure)

-or-

• SIG 20020.0 (HTTP Authentication Brute Force Attempt)

Or, create a custom signature based off of one of the above.