Use Auto-Tagging to block failed Global Protect login attempts

[Fluck]

hi,

we use SAML for our Global Protect Portal and Gateway Authentication, so all logins are automatically forwarded to our IdP and are being processed there.

But for whatever reason we sometimes face Brute Force attacks on our portal, where all kinds of generic users are being tried to authenticate against the Portal:

for my understanding this login attempts will never be sucessful, as its not even forwarded to our IdP.

I guess it's a curl that is doing these login attempts.

but however, I take failed logins serious and have a Policy that blocks all traffic from these source IPs.

This list already got very long and I want to avoid doing this in a manual way.

I found there is a way of using auto-tags for automated security actions:
Use Auto-Tagging to Automate Security Actions (paloaltonetworks.com)

unfortunately this manual explains it very well for Authentication, Data, Threat, Traffic, Tunnel Inspection, URL, and WildFire logs, where rules work perfectly, but my required Global Protect Logs are only mentioned to be configured at Device - Log settings, where I can not configure a build-in Action, like automatic Tagging.

So I wonder how I can automate my policy with the mentioned Global Protect Logs?

[Claw4609]

Hello,

Assuming you have a vulnerability profile applied on your GP interface, is it triggering the brute force vulnerability? You can make various changes to this ID to fit your needs. Where you can set the action to block IP. 

At the end of the day, while certain actions can be taken, its a public facing site, you're going to have people trying to get into it. Depending on your SAML auth you could always set certain restrictions on that side as well. Presumably its not being forwarded to your IdP because they arent specifying the domain.

[Fluck]

Hi,

yes, a vulerability profile is applied on the GP interface, but it is not triggered, because there are only 2 logins within a 7 minute timerange.

of course i can configure the vulnerability protection for up to 2 logins within a 10 minute timerange, but i though there was a better way to archive this, as it was also mentioned in a reddit post, that auto tag is the better option:

Block GlobalProtect brute force attack? : r/paloaltonetworks (reddit.com)

but they are also only referring to the Auto tagging article of Palo Alto which doesn't really explain how to do it in on the log settings.

[Raido_Rattameister]

Be careful with brute force signature 40017.

It counts how many 32256 events happen during configured amount of time.

Issue is that both successful and failed logins generate 32256.

So if you have multiple users connecting to GlobalProtect from same source IP it is easy to trigger 40017 and block source IP of legit users.

[Fluck]

has noone any idea how to block these Brute Force attacks?

we currently get about 5.000 attempts per day, each of them creates a ticket through our system log that creates an email.

So right now I check the IP in the email and put it manually in a policy of blocked IPs.

Then I have to close each ticket, which almost costs me half of the day.

Of course i can filter out the logon attempts, but that would just mean I don't see it anymore, not that I block these attacks.

I don't get why the Palo Alto documentation is sometimes so extremely bad.