topic Re: Setting Failed Attempts and Lockout Time in GlobalProtect Discussions

Setting Failed Attempts and Lockout Time

MFacella1 — Wed, 27 Sep 2023 15:29:33 GMT

Hello,

I would like to set failed attempts and lockout time on my Global Protect auth profile but I do not see where I can set this. The only place I see these settings is in the global profile but I would like to set this only for Global Protect. I am using v 10.2.4-h2

Thanks for any thoughts.

MJF

Re: Setting Failed Attempts and Lockout Time

Raido_Rattameister — Thu, 28 Sep 2023 13:58:17 GMT

Lockoud time can be configured at
Device > Authentication Profile > Auth-Profile-Name > Advanced tab

You can also adjust vulnerability signature 40017 (Objects > Security Profiles > Vulnerability protection) if source IP should be blocked after specific number of failed login attempts.

Re: Setting Failed Attempts and Lockout Time

OtakarKlier — Thu, 28 Sep 2023 16:16:13 GMT

Hello,

If your GP uses something like active directory, you could use a GPO to set something like, lockout after <> failed attempts and unlock after <>minutes.

Regards,

Re: Setting Failed Attempts and Lockout Time

MFacella1 — Thu, 28 Sep 2023 16:26:38 GMT

Thanks Raido

I will try the vulnerability Profile. When I go to the Auth profile and advanced, I am only seeing the allow list.

MJF

Re: Setting Failed Attempts and Lockout Time

Raido_Rattameister — Thu, 28 Sep 2023 16:30:08 GMT

SAML Profile for example don't have this option. You need to configure lockout on SAML/2FA provider side.

Re: Setting Failed Attempts and Lockout Time

DSharretts — Tue, 03 Oct 2023 19:39:13 GMT

Can you provide details on how to do that? I've seen ID 40017 mentioned in older documentation but can't find anything that references how to do it. I'm trying to block IPs after a certain number of failed GP portal login attempts - I've got numerous brute force attempts happening.

Re: Setting Failed Attempts and Lockout Time

MFacella1 — Tue, 03 Oct 2023 21:11:52 GMT

If you go to Objects security profiles you can create a vulnerability profile there. If you add a vulnerability profile you can go to Exceptions and check all signatures then search for 40017 to edit. I was able to stop the brute force attacks by disabling the VPN web portal page because all my VPN users are using the client.