Request Solutions to Mitigate Brute-Force Attacks on AnyConnect VPN

[ALI12]

Dear Team,

We are currently using AnyConnect VPN, with authentication for domain users managed through the RADIUS server.

Recently, we've noticed persistent brute-force attacks targeting non-existent user accounts from various countries.

Given our current setup on the ASA 5516 (version 9.12(4)2), is it possible to implement country-based whitelisting to restrict login attempts.

Alternatively, are there other solutions or best practices we could consider to enhance security?

Your recommendations and suggestions would be greatly appreciated.

[Rob Ingram · Accepted solution]

@ALI12 refer to this guide for more information, which is the latest recommendations from Cisco to protect from brute force attacks.

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-threat-defense/221806-password-spray-attacks-impacting-custome.html

There is no Geolocation that can filter traffic "to" the ASA itself, you could configure a control-plane and allow or explictly deny certain networks, although not a great solution. Else install an FTD with Geolocation in front of the ASA or use an MFA which also has Geolocation functionality.

[ALI12]

Thank you, @Rob Ingram  for sharing your insights!

which option do you think is better: control-plane or using FTD ?

[Rob Ingram]

@ALI12 The control-plane ACL on the ASA is not very scalable and a lot of effort to setup and maintain. Use an FTD with Geolocation in front of the ASA to permit/restrict traffic is the best solution, albeit there will be a cost involved.

[ALI12]

@Rob Ingram 

Thank you so much; I truly appreciate it.

[ALI12]

Dear Team,

We are currently using AnyConnect VPN, with authentication for domain users managed through the RADIUS server.

Recently, we've noticed persistent brute-force attacks targeting non-existent user accounts from various countries.

Given our current setup on the ASA 5516 (version 9.12(4)2), is it possible to implement country-based whitelisting to restrict login attempts.

Alternatively, are there other solutions or best practices we could consider to enhance security?

Your recommendations and suggestions would be greatly appreciated.

[ALI12]

Dear Admin,

Could you please remove the topic I posted? I have already reposted it in the correct group, as shown below:

https://community.cisco.com/t5/vpn/request-solutions-to-mitigate-brute-force-attacks-on-anyconnect/m-p/5207838#M297464