https://live.paloaltonetworks.com/t5/next-generation-firewall/how-could-i-drop-quot-unknown-radius-authentication-protocol/m-p/588290#M3240 <P>Hi!</P> <P>Recently we were receiving in our environment alerts of failed authentications from different random IP's and random usernames, i was able to reduce them following the next article:&nbsp;<A href="https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJ2CAK" target="_blank">Detecting Brute Force Attack on GlobalProtect Portal Page - Knowledge Base - Palo Alto Networks,</A>&nbsp;and creating a dynamic list, adding tags with forward logs, dropping these attempts and blocking the IP's.</P> <P>&nbsp;</P> <P>This reduced a loot, of this, but i keep getting some of them, i would like to tag also the "unknown RADIUS authentication protocol" but i don't see any similar in the log forwarding filters.</P> <P>&nbsp;</P> <P>Any suggestions? Regards!</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="RTudon_0-1717006652029.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/60088iD5BCD24BA077BA6E/image-dimensions/800x42/is-moderation-mode/true?v=v2" width="800" height="42" role="button" title="RTudon_0-1717006652029.png" alt="RTudon_0-1717006652029.png" /></span></P> <P>&nbsp;</P> Wed, 29 May 2024 18:20:37 GMT R.Tudon 2024-05-29T18:20:37Z https://live.paloaltonetworks.com/t5/next-generation-firewall/how-could-i-drop-quot-unknown-radius-authentication-protocol/m-p/588290#M3240 <P>Hi!</P> <P>Recently we were receiving in our environment alerts of failed authentications from different random IP's and random usernames, i was able to reduce them following the next article:&nbsp;<A href="https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJ2CAK" target="_blank">Detecting Brute Force Attack on GlobalProtect Portal Page - Knowledge Base - Palo Alto Networks,</A>&nbsp;and creating a dynamic list, adding tags with forward logs, dropping these attempts and blocking the IP's.</P> <P>&nbsp;</P> <P>This reduced a loot, of this, but i keep getting some of them, i would like to tag also the "unknown RADIUS authentication protocol" but i don't see any similar in the log forwarding filters.</P> <P>&nbsp;</P> <P>Any suggestions? Regards!</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="RTudon_0-1717006652029.png" style="width: 800px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/60088iD5BCD24BA077BA6E/image-dimensions/800x42/is-moderation-mode/true?v=v2" width="800" height="42" role="button" title="RTudon_0-1717006652029.png" alt="RTudon_0-1717006652029.png" /></span></P> <P>&nbsp;</P> Wed, 29 May 2024 18:20:37 GMT https://live.paloaltonetworks.com/t5/next-generation-firewall/how-could-i-drop-quot-unknown-radius-authentication-protocol/m-p/588290#M3240 R.Tudon 2024-05-29T18:20:37Z