Our ISE environment only authenticates wired connections and passes VPN authentication from our ASA firewalls on to our Active Directory. One of our VPN firewalls gets brute forced hit pretty hard. Luckily it is with attempts with usernames we don't have, so no users get locked out due to our actual AD user names and email addresses are different (the attempts are vastly email usernames). But recently we did have one user who actually gives out his email address alias that is his actual AD username and these hackers got a hold of it and his account would get locked out on the AD as soon as it was re-enabled due to the brute force attempts. We had to get creative in adding something to our Policy set for our guest VPN firewall to get it to stop passing authentication traffic to our AD for this particular user and keep it from locking them out. But we don't want to have to do that each time they get a hold of a real AD username. The Context Visibility and RADIUS Live Logs show they only do a few usernames attempts at a time over and over, the MAC is always different, but the attempts will come from the same IP for about 2-3 minutes before it changes. Is there a way to set something up that after so many failed authentications on our AD from the same public IP that ISE will block anymore attempts from that IP for good unless we remove it from a list? And if it can be done, would it require using Threat-Centric NAC and Adaptive Network Control? I found something online say it may be possible using those two, but it did not elaborate on details. Any help and insight is appreciated.
