Automatically blocking IP's after a certain number of Global Protect pre-login failures?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

Automatically blocking IP's after a certain number of Global Protect pre-login failures?

L3 Networker

I've just recently started getting blasted with Global Protect portal pre-login failures, coming from a bunch of illegitimate IP's. They all fail because I use certificate authentication and the client cert is not present on the attacker's device.  I have have the NGF set up to email me every time this happens and I'm getting just blasted with emails. I only use Global Protect for remote management. 

 

See screenshot of some of the IP's attempting to gain access.  I keep blocking IP's but then the attacker uses new ones. 

 

 

My question is, is there a way to automatically block IP's after a certain number of Global Protect pre-login failures?

 

Thanks!

 

 

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

@pomologist,

Automatic remediation of failed logins is something that I always script through the API. The easiest way to do that is creating a custom report on the firewall and using the API to collect the report on a scheduled basis. Have the script parse the IPs that are failing to login and add it to an EDL that you have configured to on the firewall and create a security rulebase entry to drop all traffic from any IP address located within the EDL.

View solution in original post

3 REPLIES 3

Cyber Elite
Cyber Elite

@pomologist,

Automatic remediation of failed logins is something that I always script through the API. The easiest way to do that is creating a custom report on the firewall and using the API to collect the report on a scheduled basis. Have the script parse the IPs that are failing to login and add it to an EDL that you have configured to on the firewall and create a security rulebase entry to drop all traffic from any IP address located within the EDL.

I am new to scripting and the API.  Where do you go on the firewall for this?  I have found this type of traffic and would sure like to get it blocked a different way then manually blocking them one at a time.

L1 Bithead
  • 1 accepted solution
  • 5615 Views
  • 3 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!