topic Re: Brute Force GlobalProtect Portal via GP app in Custom Signatures

Brute Force GlobalProtect Portal via GP app

alexg_8 — Mon, 27 Mar 2023 14:00:17 GMT

I'm looking for a way to define a custom signature that can detect brute force attempts on the GlobalProtect portal that aren't based on the portal login page. I already have ID 40017 - VPN: Palo Alto Networks SSL VPN Authentication Brute Force Attempt - in place and working fine, however I realized that I'm seeing attacks now where someone has managed to replicate the auth sequence from the GP app itself. I've attempted using the following, but am not having any luck with it detecting my failed attempts:

Wireshark shows a 512 HTTP status code is returned when the auth fails:

I'm sure I'm missing something, so please let me know if you spot it or have dealt with this before.

Re: Brute Force GlobalProtect Portal via GP app

nikoolayy1 — Mon, 03 Apr 2023 14:08:20 GMT

If 512 is returned by the Palo Alto firewall maybe this is an issue why the signature does not work as the response is comming from the control plane.

You can try selecting transaction not session or as another workaround you can try placing the globalprotect gateway on the loopback interface https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKPCA0 / https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJHCA0 as maybe then firewall will match the signature when passing through the reply from the dataplane interface.

Re: Brute Force GlobalProtect Portal via GP app

qdimclark — Mon, 05 Feb 2024 16:01:06 GMT

Hi,

Just chiming in that we are seeing the same things.

While it is nice to know that we're not the only ones, it's not nice that it's happening at all.

Up to 3 attempts per minute.

Switching IPs after one or two attempts.
Version showing Browser
Usernames appear to come from a compiled list.
Clientless VPN and Portal page disabled.
SSO and MFA enabled.

Management won't allow more region blocking than just the usual suspects.

We certainly need a better solution.

Re: Brute Force GlobalProtect Portal via GP app

Furio1 — Mon, 04 Mar 2024 14:57:01 GMT

Seeing the same. Causing GP vpn users to be unable to connect if we leave the GP Portal up.

Tried setting "Detecting Brute Force Attack on GlobalProtect Portal Page":

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJ2CAK

I set the hits frequency for 5 in 60 sec but it does not appear that the profile is triggered so no ips are blocked.

We restricted region to just US and it did not matter.

Re: Brute Force GlobalProtect Portal via GP app

nikoolayy1 — Sun, 24 Aug 2025 18:50:53 GMT

If the issue is still there it could be that the palo alto generates the response code itself and an external server (not a transit traffic) so try doing rate limiting only based on the request. Also see How to Write Palo Alto Networks Custom Vulnerability and Application Signatures with Examples that I have made with usefull examples.

Re: Brute Force GlobalProtect Portal via GP app

nikoolayy1 — Sun, 24 Aug 2025 18:54:25 GMT

Also see the article as there already existing signatures for this How to Protect GlobalProtect Portal on NGFW from Brute Force At... - Knowledge Base - Palo Alto Networks