VPN Portal getting hammered by password spraying attacks - Russia and elsewhere

Hello, 

Could you also try the recommendation from dirk on this thread if it suits for your current setup:  How to create a sample rule for password spraying attacks 

Kindly let us know of the outcome. 

Regards,

I initially used the ACL block after 9/4 to bloick all countires that we do not work with and the specic IP's but this time they have come back with hundreds of different IP's from locations we do use (Like US), so blocking these countries does not work as in the original suggestion. What is needed is some sort of "auto-block" feature that will block IP addresses after a number of failed attempts (like fail2ban).

Alternatively, we need to be able to not expose the VPN portal and still have access to use ssl vpn and vpn provisioning.

Hi,

Kindly check the following Post for reference

 RE: Disabling VPN portal breaks SSLVPN connections 

Yes, I am monitoring, though since that specific question is marked as answered, I think this topic of how to better handle this situation for all sophos firewall costomers getting hit by these attacks seems to need more re-focus.

I was seeing the same issue with our XG330.  It initially started from an alert for "too many login attempts".  I tried adding the specific IP address 92.53.65.166 to the block list but was still seeing the login attempts every hour.  Workaround was to disable the VPN Portal access from the internet.

We’re seeing login attempt from same IP 92.53.65.166 across multiple customers. Created blackhole-NAT or disabled WAN portals.

Please see https://support.sophos.com/support/s/article/KBA-000009932 for information on this issue.