topic Re: VPN Login Failures in GlobalProtect Discussions

VPN Login Failures

Arunkumar27 — Thu, 31 Aug 2023 07:22:45 GMT

Hi,

I received two kinds of events when I tried to connect VPN. Which event I can consider as a threat.

I have excluded the username pre-logon from monitoring but for the destination 0.0.0.0 is receiving.

Why destination IP show 0.0.0.0? Can I ignore it?

Destination IP as 0.0.0.0

<14>Aug 31 10:00:24 PA-FW1 1,2023/08/31 10:00:24,016301009873,GLOBALPROTECT,0,2562,2023/08/31 10:00:24,vsys1,portal-auth,login,ldap,,Arun,IN,DELT100344,157.38.38.164,0.0.0.0,0.0.0.0,0.0.0.0,285fef3b-21ea-41ba-b85c-7d5964db38d9,FTTVXB2,5.0.10,Windows,"Microsoft Windows 10 Enterprise , 64-bit",1,,Authentication failed: Invalid username or password,,failure,,0,pre-logon,18,SSL-VPN-PROTAL,7269186445733142702,0x8000000000000000,2023-08-31T10:00:24.120+05:30,,,,,,97,0,0,0,,FW1-PA-FW-SEC,1

Destination IP is our server address:

Thanks

Re: VPN Login Failures

felipeorozco — Fri, 01 Sep 2023 18:58:59 GMT

I don't understand your case, but if use Pre-Logon include routes because these routes try communicate with LDAP, if otherwise, if have profiles SAML, check if the pool IP address can access to the Internet. I had a customer environment similar at you, but the Pre-Logon have include routes to the LDAP, and the second session in the gateway have a SAML profile. This maybe works but it's neccesary deploy with anysome integration.

Re: VPN Login Failures

Arunkumar27 — Mon, 04 Sep 2023 06:24:50 GMT

Hi,

I have a SIEM use case for VPN login failures followed by success to the same user after 5 failures.

When I check the event, I could see the source is external IP as expected and destination is 0.0.0.0 and with our internal VPN gateway IP alternatively.

Here I am getting confusion should I consider the destination IP 0.0.0.0 also or we can ignore it for failures.

Thanks