topic Re: prevent-brute-force-attacks in General Topics

prevent-brute-force-attacks

dshastri — Fri, 06 Dec 2024 20:45:03 GMT

Hello Everyone

I am looking for suggestions on how we could protect our GlobalProtect VPN. We have been seeing people trying to perform brute-force attacks on random user accounts daily. We do have MFA set up, but is there any automation we could implement with Palo Alto Firewall to automatically block IP addresses after a certain number of failed attempts?"

Re: prevent-brute-force-attacks

TomYoung — Fri, 06 Dec 2024 23:00:26 GMT

Hi @dshastri ,

Here is a great place to start. https://www.packetswitch.co.uk/how-to-protect-globalprotect-portal-from-brute-force-attack/

I have used all of these methods. They will significantly decrease the amount you are getting.

The 4th one is a vulnerability signature that does mostly what you ask. I found it to not be as effective since most of my hackers were low and slow. The signature only detects login attempts and not failures. So, you can't tune it too tight or valid users may be blocked.

GP can still be used without the portal page enabled. (You actually can still download software by going to https://your.domain.com/global-protect/getsoftwarepage.esp, but that's another story.)

Thanks,

Tom

Re: prevent-brute-force-attacks

OtakarKlier — Mon, 09 Dec 2024 22:49:11 GMT

Hello,

In addition to this, I recommend implmenting Zone Protection profiles.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clm9CAC

Regards,

Re: prevent-brute-force-attacks

dshastri — Wed, 11 Dec 2024 14:28:20 GMT

Thank You TomYoung the only thing I am missing from the documentation was Blacklist IPs Using a Vulnerability Profile. Do you know if Palo Alto has a pre authentication check where if the user doesn't exist on the group, it drops the connection?

Re: prevent-brute-force-attacks

TomYoung — Mon, 16 Dec 2024 20:26:33 GMT

Hi @dshastri ,

The NGFW does not know the user until authentication. There is no pre-authentication check as far as I know.

Thanks,

Tom

Re: prevent-brute-force-attacks

nikoolayy1 — Sun, 17 Aug 2025 17:06:52 GMT

You need to implement rate limiter as if source IP addresses try the login page you don't need to check if the response was ok.

See my article :

How to Write Palo Alto Networks Custom Vulnerability and Application Signatures with Examples | Palo Alto Networks

Re: prevent-brute-force-attacks

TomYoung — Wed, 20 Aug 2025 15:40:38 GMT

Here is an updated article with multiple methods.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000010zEJCAY&lang=en_US

Thanks,

Tom