Blacklist threat attackers?

[cenders]

In addition to dropping packets of an attacker (say the RDP Brute Force which I get a lot of), is it possible to auto-blacklist the attacker IP address after a certain number of attempts?  It would then block all traffic from that source?

[skrall]

This is not possible. We do a feature in the  NETWORK tab called "Zone Protection" where you can set thresholds for generating alerts as well as when to start dropping packets.

Steve Krall

[jleung · Accepted solution]

Hi,

Actually for brute force attack you can choose blockIP as the action after several failed attempts. You can setup the no.opf failed attempts within what interval that should trigger the block IP by clicking on the icon next to the vul sig name under object-> vulnerability.

Regards,

Jones

[cenders]

Sorry, I can't find that option.  When I go to objects, there is no "vulnerabilities" listed on the left menu.  I am running PAN OS 4.0.5.  I have Vulnerability Protection under Security Profiles, but that doesn't let me look at each individual vulnerability.  There is Vulnerability under Custom Profiles but that is blank.  I recall somewhere seeing the complete list of vulnerabilities, but I can't find it...

[fredallee]

On the vulnerability protection profile, click custom instead of simple, and you will be able to see all vulnerability signatures. You can filter on just brute force attacks by typing in "brute". You can find the signature that you want and change the action to block-ip. You can setup the amount of time that you want to block all new traffic, and if you want it based on the source IP only or both source and destination IP. Additionally, you can customize the brute force attack thresholds by clicking on the pencil icon next to the signature name.

Alfred