VPN Login Failures

Showing results for 
Show  only  | Search instead for 
Did you mean: 

VPN Login Failures

L1 Bithead


I received two kinds of events when I tried to connect VPN.  Which event I can consider as a threat.

I have excluded the username pre-logon from monitoring but for the destination is receiving.


Why destination IP show Can I ignore it?


Destination IP as


<14>Aug 31 10:00:24 PA-FW1 1,2023/08/31 10:00:24,016301009873,GLOBALPROTECT,0,2562,2023/08/31 10:00:24,vsys1,portal-auth,login,ldap,,Arun,IN,DELT100344,,,,,285fef3b-21ea-41ba-b85c-7d5964db38d9,FTTVXB2,5.0.10,Windows,"Microsoft Windows 10 Enterprise , 64-bit",1,,Authentication failed: Invalid username or password,,failure,,0,pre-logon,18,SSL-VPN-PROTAL,7269186445733142702,0x8000000000000000,2023-08-31T10:00:24.120+05:30,,,,,,97,0,0,0,,FW1-PA-FW-SEC,1


Destination IP is our server address:


<12>Aug 31 10:00:24 PA-FW1 LEEF:2.0|Palo Alto Networks|PAN-OS Syslog Integration|10.2.3-h4|auth-fail|x7C|ReceiveTime=2023/08/31 10:00:24|SerialNumber=016301009873|cat=SYSTEM|Subtype=auth|devTime=Aug 31 2023 04:30:24 GMT|VirtualSystem=|Filename=FW1SSLVPN|Module=general|sev=3|Severity=medium|msg="failed authentication for user 'Arun'. Reason: Invalid username/password. auth profile 'FW1SSLVPN', vsys 'vsys1', server profile 'AB-AD_PROFILE', server address 'x.x.21.1', From:"|sequence=7269186445733173709|ActionFlags=0x8000000000000000|DeviceGroupHierarchyL1=0|DeviceGroupHierarchyL2=0|DeviceGroupHierarchyL3=0|DeviceGroupHierarchyL4=0|vSrcName=|DeviceName=PA-FW1





L1 Bithead

I don't understand your case, but if use Pre-Logon include routes because these routes try communicate with LDAP, if otherwise, if have profiles SAML, check if the pool IP address can access to the Internet. I had a customer environment similar at you, but the Pre-Logon have include routes to the LDAP, and the second session in the gateway have a SAML profile. This maybe works but it's neccesary deploy with anysome integration.

Felipe Orozco | Cybersecurity Engineer | PCNSE, PCNSC

L1 Bithead


I have a SIEM use case for VPN login failures followed by success to the same user after 5 failures.

When I check the event, I could see the source is external IP as expected and destination is and with our internal VPN gateway IP alternatively.

Here I am getting confusion should I consider the destination IP also or we can ignore it for failures.



  • 2 replies
  • 47 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!