topic Re: GlobalProtect - bruteforce - limit user/password guessing in GlobalProtect Discussions

GlobalProtect - bruteforce - limit user/password guessing

LukaKrizman — Fri, 24 Jan 2025 09:23:52 GMT

I now that this topics was discussed 100X times about GlobalProtect bruteforce.

It is possible po setup GlobalProtect policy in a way, if a user is not part of any AD group, than no AD/LDAP authentication is beeing trigered to internal AD.

We are seeing bruteforce attempt with non-existing AD users and we want to limit this.

Br, Luka

Re: GlobalProtect - bruteforce - limit user/password guessing

BPry — Sun, 26 Jan 2025 04:52:06 GMT

@LukaKrizman,

This isn't a possibility in PAN-OS at the moment. PAN-OS will always attempt to authenticate the user provided and then validates that user against the allow list if the authentication was successful.

You could automate blocking any IP address that attempts to login with an invalid username easily before waiting for a bruteforce to actually be identified. I'd personally have some logic to validate that the IP address isn't in the list of the current or previous users for the gateways prior to blocking it though; people have sausage fingers and you'd need a bit of logic to prevent blocking legitimate users who just mistype their username.

Re: GlobalProtect - bruteforce - limit user/password guessing

LukaKrizman — Mon, 27 Jan 2025 08:15:46 GMT

Is there any chance to push this feature into development? Does anybody knows how to report to PA to do it?