How could i drop"unknown RADIUS authentication protocol"?

[R.Tudon]

Hi!

Recently we were receiving in our environment alerts of failed authentications from different random IP's and random usernames, i was able to reduce them following the next article: Detecting Brute Force Attack on GlobalProtect Portal Page - Knowledge Base - Palo Alto Networks, and creating a dynamic list, adding tags with forward logs, dropping these attempts and blocking the IP's.

This reduced a loot, of this, but i keep getting some of them, i would like to tag also the "unknown RADIUS authentication protocol" but i don't see any similar in the log forwarding filters.

Any suggestions? Regards!