Lockouts caused by VPN password spray attack

[smartnet@netgainis.com]

Hello,

     We are using Duo for both Remote Access VPN on a Cisco firewall and our Office 365. Recently, password spray attacks against the VPN have been causing some of our users to become locked out of Office 365. We have enabled threat detection features on the firewall to block the worst offending IP addresses, but it doesn't really help with attacks against a single user that are originating from multiple public IPs.

    Duo policy only allows us to set the lockouts to occur after X number of consecutive failed logins. Does anyone know a solution or workaround to this issue that does not involve completely disabling the Duo lockout feature?

Thanks,

Reuben

[rcomeau]

You would need certificate based VPN to completely stop password sprays.

I may put a feature request in to Duo though, it would be great if Trusted Endpoints for SAML validated before authentication, this would be the equivalent to cert based option.