topic HELP - I have a hacker trying to use SPECIFIC users to get into my VPN service in GlobalProtect Discussions

HELP - I have a hacker trying to use SPECIFIC users to get into my VPN service

AndrewBytes — Wed, 11 Oct 2023 15:14:45 GMT

The pattern is they try nonsense users such as "cisco" and I block their IP they come from, but they always come back. I am getting frequent attempts with various other users, but they seem to come back within an hour of me blocking their IPs.

I need a rule that immediately blocks the user, potentially one that could add to a dynamic IP list discouraging return visits, BUT I'd be HAPPY if the user tries with "cisco" is rejected and the connection dropped. My Policy contains the users, but I'm afraid the timing is off since this isn't a "Connection" policy, but a reaction policy.

Re: HELP - I have a hacker trying to use SPECIFIC users to get into my VPN service

MNoble — Wed, 11 Oct 2023 18:55:34 GMT

Welcome to the club. 2FA and limiting login by geographic location is the only thing you can do, I believe.

There's nothing like Fail2ban that will do what you're wanting.

Re: HELP - I have a hacker trying to use SPECIFIC users to get into my VPN service

TomYoung — Thu, 12 Oct 2023 11:01:49 GMT

Hello @AndrewBytes ,

I have found that disabling the portal login page (under the General tab) has removed 99% of those attempts. You can re-enable it temporarily if someone needs to download the client.

Thanks,

Tom

Re: HELP - I have a hacker trying to use SPECIFIC users to get into my VPN service

AndrewBytes — Thu, 12 Oct 2023 17:08:59 GMT

@TomYoung wrote:

Hello @AndrewBytes ,

I have found that disabling the portal login page (under the General tab) has removed 99% of those attempts. You can re-enable it temporarily if someone needs to download the client.

Thanks,

Tom

I know I'm asking a dumb question, but this absolutely won't block the VPN client we have coming in?

I am getting "scanned" a lot - I wanna get rid of those guys too - they make me grumpy!

Re: HELP - I have a hacker trying to use SPECIFIC users to get into my VPN service

TomYoung — Thu, 12 Oct 2023 17:13:11 GMT

Hi @AndrewBytes ,

Correct. My portal login page is disabled, and GP works fine.

The bots irritate me, too, or they did. 😀

Thanks,

Tom