Suspicious VPN log in attempts - do you guys also get this?

[RandyMeng]

We don't have users in Switzerland / Netherlands, but I can see consistent log in attempts from the GlobalProtect logs.

I know the true locations is masked, but this is a persistent thing, wondering if you guys also get this?

I've geo-blocked suspicious regions already, but these log ins still visible, maybe my policy is not working right.

Probably implement MFA for GlobalProtect as well.

[PeterMS]

Hi RandyMeng,

we also see these kind of logins.

The Source User "cole" is not a real user. Right?

The "attacker" may also use real login names. That is, because you maybe use the URL "vpn.abcde.com" and the attacker find some abcde.com email addresses on Linkedin or your website.

The world strongly recommends to activate MFA for any kind of logins!

You can also use HIP profiles (if GlobalProtect license is active) or certificates to protect you from credential theft.

Double check your geo blocking rule.

• Run this block rule as the first policy (or after first one or two default rules)
• Select all allowed regions as Source Address and then negate (checkbox below) the selection.
  Don't forget to add your internal networks!

Hope this helps.

Regards,

Peter

[RandyMeng]

Correct, Cole is not a real user, I think they're just brute force and throwing mud on the wall. It'd be nice to block even the attempts all together, hence the geo-block policy.