topic Re: Automatically blocking IP's after a certain number of Global Protect pre-login failures? in General Topics

Automatically blocking IP's after a certain number of Global Protect pre-login failures?

pomologist — Thu, 09 Nov 2023 23:52:14 GMT

I've just recently started getting blasted with Global Protect portal pre-login failures, coming from a bunch of illegitimate IP's. They all fail because I use certificate authentication and the client cert is not present on the attacker's device. I have have the NGF set up to email me every time this happens and I'm getting just blasted with emails. I only use Global Protect for remote management.

See screenshot of some of the IP's attempting to gain access. I keep blocking IP's but then the attacker uses new ones.

My question is, is there a way to automatically block IP's after a certain number of Global Protect pre-login failures?

Thanks!

Re: Automatically blocking IP's after a certain number of Global Protect pre-login failures?

BPry — Fri, 10 Nov 2023 22:14:51 GMT

@pomologist,

Automatic remediation of failed logins is something that I always script through the API. The easiest way to do that is creating a custom report on the firewall and using the API to collect the report on a scheduled basis. Have the script parse the IPs that are failing to login and add it to an EDL that you have configured to on the firewall and create a security rulebase entry to drop all traffic from any IP address located within the EDL.

Re: Automatically blocking IP's after a certain number of Global Protect pre-login failures?

Ken_Cousino — Thu, 04 Jan 2024 21:58:47 GMT

I am new to scripting and the API. Where do you go on the firewall for this? I have found this type of traffic and would sure like to get it blocked a different way then manually blocking them one at a time.

Re: Automatically blocking IP's after a certain number of Global Protect pre-login failures?

MikeGill — Wed, 24 Jan 2024 05:15:36 GMT

A bit late, but did you see this article? Detecting Brute Force Attack on GlobalProtect Portal Page - Knowledge Base - Palo Alto Networks