topic Global Protect in GlobalProtect Discussions

Global Protect

Satyak — Sat, 27 May 2023 18:32:14 GMT

Hi Friends,

We have a requirement related to global protect.

Condition:

User tries to connect to global protect and fails to login.

If he tries for three or more times to connect to global protect and fails to login an email alert should come to my mail id.

I have configured email alerts in my firewall but can we specifically customize by above mentioned condition.

Could you please help me with the requirement is it possible or not ?

Regards

Satya Kalyan.

Raido_Rattameister — Sun, 28 May 2023 17:58:17 GMT

Device >Authentication Profile > Auth-profile-name > Advanced Tab

Set "Failed Attempts" and "Lockout Time"

After 3 failed login attempts account will be locked.

Those attempts will generate event in "Monitor > System" but not if account locks up.

When user tries 4th time then "Monitor > System" will log event that can be tracked using following filter.

( description contains 'User is in locked users list' )

So if you set up email notification under "Device > Log Setting > System" using this filter you will get alert if locked in users try to log in.

Satyak — Sun, 28 May 2023 18:56:09 GMT

Hi Raido,

Thankyou for the information.

Regards

Satya Kalyan.