topic Re: How to shun/block an IP address for a period of time in General Topics

How to shun/block an IP address for a period of time

njoyzrd — Sat, 12 Oct 2013 14:23:05 GMT

I've worked with several traditional IPS in the past and there is always a way to create rules that shun or block a source IP address for some period before automatically resetting. It is especially useful for stopping automated bots that are just probing for flaws across the Internet.

Specifically, I'd like to create a rule that will monitor for failed login attempts to a web server located in a DMZ. After 5 failed attempts in 2 minutes, I want to block the source IP address for 10 minutes.

Can this be done?

Thanks in advance for any help!

Re: How to shun/block an IP address for a period of time

Retired Member — Sat, 12 Oct 2013 19:43:46 GMT

Hi,

You can change behaviour of signatures in vulnerability as shown in the picture (block for a periodic time).But for attempt count I don't think there is a way to do.Maybe you can write a custom signature.

Also check

https://live.paloaltonetworks.com/docs/DOC-1367

Re: How to shun/block an IP address for a period of time

kdd — Mon, 14 Oct 2013 06:55:49 GMT

Hi njoyrzd,

I would start with creating a schedule object under the objects tab. After this the schedule object can be used in a rule (under Options).

if it is not shown then it has to be enabled.

right after this you can use the schedule object in the options field of the rule.

Hope this helps

Regards Klaus

Re: How to shun/block an IP address for a period of time

jvalentine — Mon, 14 Oct 2013 15:49:57 GMT

Some of the "brute force" signatures have a picture of a pencil next to them, which allows you to Edit Time Attributes.

If you would like to shun based on an IPS signature that doesn't have a built-in time attribute, you can create a simple custom "combination" vulnerability signature. Create a new custom vulnerability signature, enter some basic information on the "Configuration" tab (name, etc.), then on the signature type, choose "Combination". Now, select the signature you wish to add some time attributes to. (This example uses Threat ID 10005).

Next, go to the "Time Attribute" tab and add the # of hits within the # of seconds, and then how you wish to aggregate the data.

Now, with your new signature, you can change the action to "block-ip" (aka shun).

Re: How to shun/block an IP address for a period of time

ISortOfKnowIT — Thu, 13 Jan 2022 17:41:42 GMT

I apologize for the ignorant question, but I can't seem to find reference to what Threat ID 10005 denotes. Is this failed logins?