AD lockouts occurring from RA-VPN brute force

[tmcG]

Scenario:

I am trying to figure out a way to prevent AD accounts from being locked out when brute force login attempts to the RA-VPN occur.

RA-VPN configured on FTD. Radius authentication used via ISE pointing to AD. DUO MFA works fine, no issues, but recently we've had a different situation occur.

Since primary authentication occurs when a user connects to VPN prior to the MFA challenge, AD gets the authentication request. This means if a botnet or script or bad actor on the internet tries to authenticate with a given username repeatedly, it locks the AD account because AD receives X number of authentication attempts and it trips our AD account lockout policy (usually 5-10 failed authentication attempts).

Cisco FTD does not have a way to stop this, and does not have any sort of identity aware DDOS or "Fail2ban" capability. Per Tac, Cisco's official recommendation is to put a firewall Infront of the firewall because RA-VPN on a FTD operates in an administrative context and no IPS/IDS functionality applies to it.

I am trying to determine if I change our configuration to point to a different IdP for primary authentication, perhaps to Azure or ADFS via SAML, can I force the MFA challenges prior to primary authentication? If not, perhaps I can use some sort of conditional access policy to prevent brute forcing causing account lockouts?

Has anyone ever encountered something like this? Any help or similar experiences are appreciated.

[Rob Ingram]

@tmcG you can use threat detection for Remote Access VPN services on FTD, which can automatically shun the host (IP address) that exceeds the configured thresholds, to prevent further attempts until you manually remove the shun of the IP address.

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/222383-configure-threat-detection-for-remote-ac.html

You need to be using version 7.0.6.3 or 7.6

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221806-password-spray-attacks-impacting-custome.html#toc-hId-1334521269

Check Cisco suggestion for this case 

MHM

[Aref Alsouqi]

What RADIUS server are you using? is it ISE? With ISE you can do the authentication via Duo and then the authorization via the AD, that way if the user responds to the Duo push they need to be part of the authorized AD group, if not the authorization will fail. So with such a setup the AD users won't be locked out by any malicious actors. If you are not using ISE your RADIUS server should allow you to configure similar setup.