Tracking VPN Brute Force

[CMPC]

Hello everyone,

Can you provide me with the eventid of the VPN failed logon on Cisco's devices?

I couldn't find any examples and i wan't to create a brute force rule for it in my SIEM solutions.

[Rob Ingram · Accepted solution]

@CMPC refer to this guide - https://www.cisco.com/c/en/us/support/docs/security/secure-client/221880-implement-hardening-measures-for-secure.html

Identify Attacks using Logging and Syslog IDs

Brute-force attacks represent the predominant method of compromising Remote Access VPNs, exploiting weak passwords to gain unauthorized entry. It is crucial to know how to recognize signs of an attack by leveraging the use of logging and evaluating syslogs. Common syslogs IDs that can indicate an attack if encountered with abnormal volume are: 

%ASA-6-113015

%ASA-6-113015: AAA user authentication Rejected : reason = User was not found : local database : user = admin : user IP = x.x.x.x 

%ASA-6-113005

%ASA-6-113005: AAA user authentication Rejected : reason = Unspecified : server = x.x.x.x : user = ***** : user IP = x.x.x.x 

%ASA-6-716039

%ASA-6-716039: Group <DfltGrpPolicy> User <admin> IP <x.x.x.x> Authentication: rejected, Session Type: WebVPN