topic Re: Block FTP Brute Force Attemps - Threat ID 40001 in General Topics

Block FTP Brute Force Attemps - Threat ID 40001

hnederstigt — Thu, 05 Jul 2012 16:49:25 GMT

Hello,

I want to block Block FTP Brute Force Attemps.

The default rule in the PA alert only in theThreat log.

I added a new Vulnerabolity Protection Rule:

Action: Block

Host type: Any (also tried Server)

Category: brute-force

Severity: Any

CVE: Any

Vendor ID: Any

I placed the rule above al the default rules (see attachment).

If I simulate a ftp brute force attack I only see a alert message in the Threat log.

thanks in advance for your reply,

Hans

Re: Block FTP Brute Force Attemps - Threat ID 40001

drogers — Thu, 05 Jul 2012 18:55:32 GMT

Try changing the action to 'block-ip'. Block will only block the packet/session related to the violation, which doesn't work very well for attacks based on cumulative attempts.

Re: Block FTP Brute Force Attemps - Threat ID 40001

fredallee — Thu, 05 Jul 2012 19:05:34 GMT

What is the actual signature that is being enabled behind that exception rule? Is it a custom sig or the Palo Alto Networks ftp brute force sig?