Block IP addresses after too many failed VPN attempts

[TJ-20933766]

I've been curious to see if there is any mechanism in the ASA and/or router that would work similarly to the "login block-for" command but for remote access VPN. In short, I find lots of failed login attempts in the logs and I'd like to be able to block those IP addresses at least for a short amount of time so they do not just hammer the ASA/router trying to get in. Is there such a configuration?

[Marvin Rhoads]

I'm not aware of any such command or configuration you can do on the ASA or router natively.

I have seen one customer with an IDS creates a script that sends a shun command to the ASA and adds the source address to a blacklist ACL. I always thought that was more trouble than it was worth though, personally.

If there is an IPS upstream and the source of the failed attempts appears to be consistently from one or another country where you don't have any legitimate need for incoming communcations, you might be able to use a Geolocation blacklist to block all traffic from those locations.