Look solution to mitigate VPN bruteforce attack

[Da ICS16]

Dear Community,

We explore the solution to mitigate VPN brute force attack in Cisco FTD. 

AD users always locked out when under targeting  potential VPN brute force attacks so it leads to AD account locked out and impact to legit users (internal user). 

Flow: FTD -> ISE.

ISE has connectivity to AD and 2FA (OTP). On ISE get source form FTD and on ISE Policy Set (Authentication methods: PAP/ASCII or MSCHAPv2, NAS-PORT-TYPE: Virtual).

- We enabled "AD account locked out policies , eg: 5 failed attempt"  server.

- ISE features tested: 'Reject RADIUS requests from clients with repeated failures', 'Prevent Active Directory User Lockout' but cannot blocked AD user on ISE.

We user ISE 3.1, Cisco Secure Client VPN agent 5.x

Could you share commend / good practice to prevent / mitigate this kind of vpn brute force attacks? To ensure no AD locked on target users.

Well appreciated for you supporting.

Best Regards,

[Rob Ingram]

@Da ICS16 you can enable threat detection capability, this may require a patch/upgrade as this is a relatively new feature. 

Once enabled, the FTD automatically shuns the host (IP address) that exceeds the configured thresholds, to prevent further attempts until you manually remove the shun of the IP address.

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221806-password-spray-attacks-impacting-custome.html

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/222383-configure-threat-detection-for-remote-ac.html

[Da ICS16]

Hello @Rob Ingram 

Thanks for your commend and supporting.

To enable threat detection capability, does it can mitigate this kind of attack even the attacker's known AD User? 

Thanks.

[Rob Ingram]

@Da ICS16 yes 

[Da ICS16]

Hello @Rob Ingram 

For we ever did even the configured threshold, tuning certificate but no luck to prevent AD user locked out.

Seem it is not the fixed solution.

[Rob Ingram]

@Da ICS16 what software version are you running? Have you confirmed that threat detection is working after you configured it, run - "show threat-detection service" and "show shun"