Distributed VPN attack

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Distributed VPN attack

L3 Networker

Recently we experience distributed VPN dictionary attack on our Palo Alto Global Protect from different countries, ISPs and hundreds of IP addresses. Since we have MFA the attack was unsuccessful so far but I want to stop it somehow. The malicious actor seems to adopt the attack to our protection measures. Originally it was addressing our GlobalProtect Portal so disabling it helped for a while but yesterday they changed the way and now I can see in logs authentication failures again.

I’m looking for advise about more sophisticated protection against these attacks. I can see in logs that the malicious actor is using:

  • client_os Linux or Ubuntu but not Windows which we have. We change OS to Windows in Gateway configuration hoping it will stop the attack at least for a while.
  • Client_ver is Browser or empty

Can somebody advise if we can apply better protection somehow?

Also, I would like to set different rule based protection to Global Protect Portal and Global Protect VPN client. In other words, Access to the Portal should be limited to one country only but the VPN should be accessible from anywhere. Is it possible?

3 accepted solutions

Accepted Solutions

L5 Sessionator

Hello, 

 

Assuming you have a vulnerability profile applied on your GP interface, is it triggering the brute force vulnerability? You can make various changes to this ID to fit your needs. Where you can set the action to block IP. 

Claw4609_0-1717447411661.png

 

Claw4609_1-1717447411663.png

 

For the second piece are you looking at protecting a separate clientless vpn page or the main portal itself? Clients grab their configurations from the portal so you wouldnt be able to block access to the portal. 

View solution in original post

Cyber Elite
Cyber Elite

Hello,

Also setup zone protection profiles to help with DoS type activity. Also only allow traffic from the countries you trust. Setup security policies to block traffic from the Palo Alto External Dynamic lists. Send Telemetry back to Palo Alto and this will help everyone else, etc.

 

Regards,

View solution in original post

4 REPLIES 4

L5 Sessionator

Hello, 

 

Assuming you have a vulnerability profile applied on your GP interface, is it triggering the brute force vulnerability? You can make various changes to this ID to fit your needs. Where you can set the action to block IP. 

Claw4609_0-1717447411661.png

 

Claw4609_1-1717447411663.png

 

For the second piece are you looking at protecting a separate clientless vpn page or the main portal itself? Clients grab their configurations from the portal so you wouldnt be able to block access to the portal. 

Cyber Elite
Cyber Elite

Hello,

Also setup zone protection profiles to help with DoS type activity. Also only allow traffic from the countries you trust. Setup security policies to block traffic from the Palo Alto External Dynamic lists. Send Telemetry back to Palo Alto and this will help everyone else, etc.

 

Regards,

Thank you!

Cyber Elite
Cyber Elite

Hello,

No worries and let us know if you need anything else.

 

Cheers!

  • 3 accepted solutions
  • 738 Views
  • 4 replies
  • 0 Likes
  • 38 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!