topic Re: Blocking VPN users after so many unsuccessful connection attempts in SASE and Remote Access

Blocking VPN users after so many unsuccessful connection attempts

the_rock — Tue, 12 Nov 2024 16:03:27 GMT

Hey guys,

I read couple of posts people ask about this in the past, but does not appear there was a concrete answer. Is there any possible way to block a user after they fail connecting to vpn after so many attempts? I know SAM rules are used to instantly block specific IP addresses, but that wont do for a user.

So, here is basic example...say user fails to authenticate to VPN site after 3 attempts, can admin block them for an hour before they can try again?

Thanks as always.

Andy

Re: Blocking VPN users after so many unsuccessful connection attempts

PhoneBoy — Tue, 12 Nov 2024 20:35:05 GMT

The only way I could see doing this is with an automatic reaction in SmartEvent.
Whether it's actually possible is a separate question.

Re: Blocking VPN users after so many unsuccessful connection attempts

the_rock — Tue, 12 Nov 2024 20:37:31 GMT

Thank you, appreciate the feedback as always!

Andy

Re: Blocking VPN users after so many unsuccessful connection attempts

JozkoMrkvicka — Tue, 12 Nov 2024 23:23:54 GMT

What is authentication method of user in question ? Simple (not secured) username/password ?

Re: Blocking VPN users after so many unsuccessful connection attempts

the_rock — Tue, 12 Nov 2024 23:36:08 GMT

In this case, yes, but I was more asking generally, regardless of what auth method is.

Andy

Re: Blocking VPN users after so many unsuccessful connection attempts

Tom_Hinoue — Wed, 13 Nov 2024 00:51:06 GMT

Hi Andy,

Not sure if it relates, but I know we have such feature for SNX but for IP addresses (not users).
https://support.checkpoint.com/results/sk/sk180271

Also I think PhoneBoy mentioned before in a different thread about using Gaia OS passwords as authentication to lockout users after failed login attempts.

https://community.checkpoint.com/t5/Remote-Access-VPN/Remote-VPN-User-account-lock-after-failed-authentication/m-p/33828#M1263

Re: Blocking VPN users after so many unsuccessful connection attempts

the_rock — Wed, 13 Nov 2024 00:56:20 GMT

Thanks Tom! Yes, I had seen that post before by Phoneboy, but sadly its not related to this exact scenario. Now, sk you mentioned, looks super interesting. I wonder if doing fw ctl set -f flag for below kernel parameter may actually work, definitely worth a try.

vpn_failed_auth_attempt_threshold

Thanks a lot again, I value the advice.

Andy

Re: Blocking VPN users after so many unsuccessful connection attempts

the_rock — Wed, 13 Nov 2024 14:19:35 GMT

Hey again Tom,

I will have a call today with my colleague and bring up this kernel parameter setting and see if client would be okay to test this out. I dont think it should be an issue, as they are smaller shop, so probably not a big hurdle, if you will, to try.

Will keep you posted. Thanks a lot again for sending this, I feel really positive about it, as setting certainly does make sense.

Andy

Re: Blocking VPN users after so many unsuccessful connection attempts

the_rock — Wed, 13 Nov 2024 15:27:07 GMT

@Tom_Hinoue

Sadly, did not work. Tested in the lab, but no joy. I believe its only applicable to snx, NOT vpn client.

Andy

[Expert@R82:0]# fw ctl set -f int vpn_failed_auth_attempt_threshold 5
"fwkern.conf" was updated successfully
[Expert@R82:0]# more /opt/CPsuite-R82/fw1/boot/modules/fwkern.conf
udp_is_verify_cksum=0
vpn_failed_auth_attempt_threshold=5
[Expert@R82:0]#

Re: Blocking VPN users after so many unsuccessful connection attempts

Arskazv — Mon, 20 Jan 2025 12:06:08 GMT

I'd also like some built in solution (similar the one for SNX clients) for VPN clients. Bruteforcing of VPN users/passwords has increased last years.

Re: Blocking VPN users after so many unsuccessful connection attempts

Arskazv — Mon, 20 Jan 2025 12:13:19 GMT

Could this be the solution:

sk182087 "How to prevent multiple unsuccessful login attempts from Endpoint Security Client users on a Security Gateway"
EDIT: Seems to be user based only...