GP Portal logs showing local password guessing attempts even though I'm using Azure IdP. Should I be concerned?

Maxstr — Thu, 04 Apr 2024 15:56:33 GMT

I have our portal set up to use Azure for logon, and it's been working great. Lately I'm seeing many of these attempts in the system logs:

1. saml-client-redirect, "Client '95.164.0.25' redirected to 'https://login.microsoftonline.com/xxxxxxxxx/saml2' for authentication profile "Azure"

2. auth-fail, Failed authentication for user 'lakiesha'. Reason: Internal error, e.g. network connection, DNS failure or remote server down. auth profile 'Azure', vsys 'vsys1', From: 95.164.0.25

It looks like it's sending them to Azure, but then returning to the firewall again and trying to login as a local user. But why is there a internal error/DNS failure error message?

topic GP Portal logs showing local password guessing attempts even though I'm using Azure IdP. Should I be concerned? in GlobalProtect Discussions

GP Portal logs showing local password guessing attempts even though I'm using Azure IdP. Should I be concerned?