Invalid Login attempts ASA syslogs

[jf1134]

We have a ASAv in Azure and all that it is used for is anyconnect. I setup a syslog server and I keep seeing all these invalid login attempts and majority of the usernames are invalid except we do see a few that are actually correct but see invalid login in AD logs. 

What are they actually trying to login to? The actual ASA? Is there a way to stop the invalid login attempts?

Here's a sample 

03-01-2024 16:32:21 Local4.Info 10.75.1.4 Mar 01 2024 10:32:16: %ASA-6-113015: AAA user authentication Rejected : reason = User was not found : local database : user = ettevroc : user IP = 94.131.97.7
03-01-2024 16:32:21 Local4.Info 10.75.1.4 Mar 01 2024 10:32:15: %ASA-6-113005: AAA user authentication Rejected : reason = Unspecified : server = 10.250.2.10 : user = ettevroc : user IP = 94.131.97.7
03-01-2024 16:32:08 Local4.Info 10.75.1.4 Mar 01 2024 10:32:02: %ASA-6-113015: AAA user authentication Rejected : reason = User was not found : local database : user = etrigan : user IP = 94.131.8.92
03-01-2024 16:32:08 Local4.Info 10.75.1.4 Mar 01 2024 10:32:02: %ASA-6-113005: AAA user authentication Rejected : reason = Unspecified : server = 10.250.2.10 : user = etrigan : user IP = 94.131.8.92
03-01-2024 16:32:05 Local4.Info 10.75.1.4 Mar 01 2024 10:31:59: %ASA-6-113015: AAA user authentication Rejected : reason = User was not found : local database : user = etrone : user IP = 77.91.74.79
03-01-2024 16:32:04 Local4.Info 10.75.1.4 Mar 01 2024 10:31:58: %ASA-6-113005: AAA user authentication Rejected : reason = Unspecified : server = 10.250.2.10 : user = etrone : user IP = 77.91.74.79
03-01-2024 16:31:38 Local4.Info 10.75.1.4 Mar 01 2024 10:31:32: %ASA-6-113015: AAA user authentication Rejected : reason = User was not found : local database : user = ettion : user IP = 5.182.39.158
03-01-2024 16:31:38 Local4.Info 10.75.1.4 Mar 01 2024 10:31:32: %ASA-6-113005: AAA user authentication Rejected : reason = Unspecified : server = 10.250.2.10 : user = ettion : user IP = 5.182.39.158
03-01-2024 16:31:29 Local4.Info 10.75.1.4 Mar 01 2024 10:31:24: %ASA-6-113015: AAA user authentication Rejected : reason = User was not found : local database : user = thomas : user IP = 185.94.33.51
03-01-2024 16:31:25 Local4.Info 10.75.1.4 Mar 01 2024 10:31:19: %ASA-6-113015: AAA user authentication Rejected : reason = User was not found : local database : user = info : user IP = 193.233.143.186
03-01-2024 16:31:25 Local4.Info 10.75.1.4 Mar 01 2024 10:31:19: %ASA-6-113005: AAA user authentication Rejected : reason = Unspecified : server = 10.250.2.10 : user = thomas : user IP = 185.94.33.51
03-01-2024 16:31:21 Local4.Info 10.75.1.4 Mar 01 2024 10:31:15: %ASA-6-113005: AAA user authentication Rejected : reason = Account has been locked out : server = 10.250.2.10 : user = info : user IP = 193.233.143.186

[Rob Ingram]

@jf1134 those syslog messages indicate someone is attempting to login to a Remote Access VPN (IPsec or WebVPN). https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs1.html#con_4769508

If you don't use RAVPN then you can disable this functionality.

[MHM Cisco World]

Usually we use acl control plane' but if you can not use acl use shun command to block these Ip

https://www.cisco.com/c/en/us/support/docs/security/ips-4200-series-sensors/111001-shun-block-config-ex.html

[jf1134]

I tried using the shun command and add the most common IP's but it doesn't seem to be working

[MHM Cisco World]

The IP you shun is try again or there are other IP try login?

MHM

[jf1134]

We are using RAVPN. This ASA is being used for AnyConnect. I think these are coming from web URL that we use for clients to download the AnyConnect client. I did a couple of invalid logs through the web url with my name and they came showed up in the Syslogs. 

[Rob Ingram]

@jf1134 if it's the web portal and you do not use it, you can disable logins, therefore no failed attempts in the syslogs.

 webvpn
  keepout "No access"