Are there retry limits on SSLVPN login attempts?
Connection to SSLVPN is to a specific IP:port, and the user supplies an ID and password. Are the any limits in the TZ400 on how many times this login can be tried and failed? If so, what are the counter measures? Is the attempting IP blocked for some period of time? Are failed attempts logged?
Category: SSL VPN
Tagged:
0
Best Answers
-
CORRECT ANSWER
MustafaA
SonicWall Employee
If a local user account is used, the following settings on your firewall should apply.
0 -
CORRECT ANSWERMustafaA
SonicWall Employee
Make sure the related Events in the Log Settings (Users > Authentication Access) are correctly configured.
0 -
CORRECT ANSWERMustafaA
SonicWall Employee
Sharing the link to the Log Event Reference Guide.
https://www.sonicwall.com/techdocs/pdf/sonicos-6-5-4-log-events-reference-guide.pdf
0
Answers
great! Are failed attempts logged?
Thanks, that will help. Is there a document/page that describes these settings in more detail so I don't have to post findable answers to the Community? For example I'd like to find out more about "User Account lockout" versus "User is now locked out" ... for how long they are locked out, temporary/permanent lockout, when/how unlocked - manual/auto, etc. Likewise info for some of the other log settings.
Your SSLVPN users may adopt some password restrictions depending on how you authenticate the users. An example would be Active Directory. If your policy says to lock the account after 4 failed attempts, the 5 default attempts don't really come into play.
Are the any limits in the TZ400 on how many times this login can be tried and failed? - No a bot/hacker can do this all day. If you have proper security, the account should lock until addressed by an administrator.
what are the counter measures? - a good security posture that monitors logs and responds when accounts are being attacked. SSO, two factor authentication.
Is the attempting IP blocked for some period of time? - This does not happen. If the account gets locked, it will only be unlocked based on the configuration you have in place. (administration page, GPO, etc)
Are failed attempts logged? Yes. You should see this in the Logs and maybe on your servers as well.
Also, note that the root admin accounts settings can differ for "user" account settings, either local database, AD, Radius etc.
Hope some of this was helpful to someone. ;-)