How could i drop"unknown RADIUS authentication protocol"?

[R.Tudon]

Hi!

Recently we were receiving in our environment alerts of failed authentications from different random IP's and random usernames, i was able to reduce them following the next article: Detecting Brute Force Attack on GlobalProtect Portal Page - Knowledge Base - Palo Alto Networks, and creating a dynamic list, adding tags with forward logs, dropping these attempts and blocking the IP's.

This reduced a loot, of this, but i keep getting some of them, i would like to tag also the "unknown RADIUS authentication protocol" but i don't see any similar in the log forwarding filters.

Any suggestions? Regards!

[PavelK · Accepted solution]

Hello @R.Tudon

you should be able to use below string in the filter builder to filter these logs out:

( description contains 'unknown RADIUS authentication protocol' )

Kind Regards

Pavel

[R.Tudon]

I tried with all the different log types, but i get this error, should I've done other thing to make this filter work?

Regards!

[BPry · Accepted solution]

@R.Tudon,

In your example it looks like you were trying to build it out for traffic, that's not where this would go. These are system events and you'd want to modify the filter for whatever log forwarding you have enabled for your system events.