VPN Login Failures

[Arunkumar27]

Hi,

I received two kinds of events when I tried to connect VPN.  Which event I can consider as a threat.

I have excluded the username pre-logon from monitoring but for the destination 0.0.0.0 is receiving.

Why destination IP show 0.0.0.0? Can I ignore it?

Destination IP as 0.0.0.0

<14>Aug 31 10:00:24 PA-FW1 1,2023/08/31 10:00:24,016301009873,GLOBALPROTECT,0,2562,2023/08/31 10:00:24,vsys1,portal-auth,login,ldap,,Arun,IN,DELT100344,157.38.38.164,0.0.0.0,0.0.0.0,0.0.0.0,285fef3b-21ea-41ba-b85c-7d5964db38d9,FTTVXB2,5.0.10,Windows,"Microsoft Windows 10 Enterprise , 64-bit",1,,Authentication failed: Invalid username or password,,failure,,0,pre-logon,18,SSL-VPN-PROTAL,7269186445733142702,0x8000000000000000,2023-08-31T10:00:24.120+05:30,,,,,,97,0,0,0,,FW1-PA-FW-SEC,1

Destination IP is our server address:

<12>Aug 31 10:00:24 PA-FW1 LEEF:2.0|Palo Alto Networks|PAN-OS Syslog Integration|10.2.3-h4|auth-fail|x7C|ReceiveTime=2023/08/31 10:00:24|SerialNumber=016301009873|cat=SYSTEM|Subtype=auth|devTime=Aug 31 2023 04:30:24 GMT|VirtualSystem=|Filename=FW1SSLVPN|Module=general|sev=3|Severity=medium|msg="failed authentication for user 'Arun'. Reason: Invalid username/password. auth profile 'FW1SSLVPN', vsys 'vsys1', server profile 'AB-AD_PROFILE', server address 'x.x.21.1', From: 157.38.38.164."|sequence=7269186445733173709|ActionFlags=0x8000000000000000|DeviceGroupHierarchyL1=0|DeviceGroupHierarchyL2=0|DeviceGroupHierarchyL3=0|DeviceGroupHierarchyL4=0|vSrcName=|DeviceName=PA-FW1

Thanks

[felipeorozco]

I don't understand your case, but if use Pre-Logon include routes because these routes try communicate with LDAP, if otherwise, if have profiles SAML, check if the pool IP address can access to the Internet. I had a customer environment similar at you, but the Pre-Logon have include routes to the LDAP, and the second session in the gateway have a SAML profile. This maybe works but it's neccesary deploy with anysome integration.

[Arunkumar27]

Hi,

I have a SIEM use case for VPN login failures followed by success to the same user after 5 failures.

When I check the event, I could see the source is external IP as expected and destination is 0.0.0.0 and with our internal VPN gateway IP alternatively.

Here I am getting confusion should I consider the destination IP 0.0.0.0 also or we can ignore it for failures.

Thanks