Distributed VPN attack

[Piotr_Kowalczyk]

Recently we experience distributed VPN dictionary attack on our Palo Alto Global Protect from different countries, ISPs and hundreds of IP addresses. Since we have MFA the attack was unsuccessful so far but I want to stop it somehow. The malicious actor seems to adopt the attack to our protection measures. Originally it was addressing our GlobalProtect Portal so disabling it helped for a while but yesterday they changed the way and now I can see in logs authentication failures again.

I’m looking for advise about more sophisticated protection against these attacks. I can see in logs that the malicious actor is using:

• client_os Linux or Ubuntu but not Windows which we have. We change OS to Windows in Gateway configuration hoping it will stop the attack at least for a while.
• Client_ver is Browser or empty

Can somebody advise if we can apply better protection somehow?

Also, I would like to set different rule based protection to Global Protect Portal and Global Protect VPN client. In other words, Access to the Portal should be limited to one country only but the VPN should be accessible from anywhere. Is it possible?

[Claw4609 · Accepted solution]

Hello, 

Assuming you have a vulnerability profile applied on your GP interface, is it triggering the brute force vulnerability? You can make various changes to this ID to fit your needs. Where you can set the action to block IP. 

For the second piece are you looking at protecting a separate clientless vpn page or the main portal itself? Clients grab their configurations from the portal so you wouldnt be able to block access to the portal. 

[OtakarKlier · Accepted solution]

Hello,

Also setup zone protection profiles to help with DoS type activity. Also only allow traffic from the countries you trust. Setup security policies to block traffic from the Palo Alto External Dynamic lists. Send Telemetry back to Palo Alto and this will help everyone else, etc.

Regards,

[Piotr_Kowalczyk · Accepted solution]

Thank you!

[OtakarKlier]

Hello,

No worries and let us know if you need anything else.

Cheers!