Brute Force Signatures

[wlu]

hi : In regard to Brute Force Vulnerability Signatures 40015 (ssh) and 40021 (rdp) :

Why is there not a way to permanently block an IP number that exceeds the configured  Number of Hits per time period? Is this possibly in the works fro a future release?

[tettema]

Currently there is no way to automatically block IPs permanently using brute force signatures.  There is a user-configurable black-hole timeout value, with a maximum of 1 hour.  However, you can list the current black hole IPs through the CLI and periodically add repeat offenders to a policy that permanently blocks those addresses. 

[RonaldGo]

hi tettema

where can i find the black-hole configuration?  or is it only from CLI?  I'm using the latest PAN-OS 4.1.0 on a PA2020...  and I get tons of brute-force attempts on various servers behind the PA2020...  oh, my PA2020 is running in transparent (vwire) mode....

thanks!

- ron

[tettema]

Hi Ron,

Select the brute force signature(s) you're interested in the Exceptions tab, and choose the action "block-ip".  Then a pop-up will appear asking you how long you want to block the IP.

[RonaldGo]

thanks!  it seems to work well...  🙂

what i did was clone the "strict" policy and added the exceptions and set them to "block-ip" for 3600 (1 hour)...  i assume that the rest of the "strict" policy still applies but the exceptions would take over when they are met?

i mean, like if the brute-force RDP is seen, it would block-ip instead of just "drop-all=packets"...  but if the PA2020 sees a remote stack overflow, it would still "drop-all-packets"...

rgds,

- ron

[wlu]

hi : Thanks for the information. What is the CLI command that shows the current temporary blackholes.

[tettema]

show dos-protection zone [zone] blocked source

[tettema]

Yes, actions specified per signature in the exceptions tab override actions specified in rules that contain that same signature.

[RonaldGo]

hi

it seems block-ip doesn't work for SMB or FTP attacks...  when PA detects the brute-force attack, it shows "block-ip" but the attacks continue almost endlessly until i block it on the router (before PA)...

is there any workaround for this?

thanks!

ronald

[tettema]

When you configure the block-ip action for a brute force signature, you can specify a time span for the block, which currently goes up to 1 hour.  You should not see successful attempts from the sampe IP against the same IP that occur inside of the time you've specified for the block-ip action.