Protecting the Mobile Access portal from password brute force

[Arturxr]

Is it possible to limit the number of password entry attempts on the Mobile Access portal?

For example, if a user enters an incorrect password 3 times, the user is blocked.

[G_W_Albrecht]

Yes, that is possible, see the Mobile Access R81 Administration Guide - it does, however, depend on the used authentication type.

[Arturxr]

Please tell me the number of the item, I read the admin guide and did not find it

[G_W_Albrecht]

Starting page 170 is User Authentication in Mobile Access. Here you select which kind of authentication should be used, and further steps are depending on it.

[Arturxr]

We have read, in our understanding it is used for 2-fa, we cannot organize dynamicid due to lack of resources, we are interested in the issue of blocking MAB users after entering the password incorrectly more than 3 times. Is there such functionality.

[G_W_Albrecht]

Not for Legacy Auth with User/Password.

[Arturxr]

it turns out that there is no such functionality?

[G_W_Albrecht]

No - what we have is sk112454 How to configure Rate Limiting rules for DoS Mitigation (R80.20 and higher), but here we talk about more than 1000 packets per second ;- ) This can be used to prevent password brute force attacks...