Forum Discussion

Aaron_Chandra_3's avatar
Aaron_Chandra_3
Icon for Nimbostratus rankNimbostratus
May 01, 2017

ASM- Brute Force Mitigation Dynamic

Hi,

 

I have a situation here, the dynamic brute force mitigation we set (after a lot of trial and error) detects the login failures however the prevention policy it is applying is not constant. lets say the attack continously happening for 4 hours, i can see from the Brute force logs, entry been created every minute with "average historical failed login=12" and "Detected failed logins=12", "Mitigation= URL based" but actually i dont see any ip's or rejected connections.. but after an hour or sometime for the same values it applied URL-Based mitigation, dropped the ip's for sometime to bring back the URL to normal usage. is there any way i can fix this prevention policy to be constant instead of on/off.. any fixed numbers i can try? any suggestion?

 

ASM Advanced WAF
security

5 Replies

Sort By
  • taunan_89710's avatar
    taunan_89710
    Historic F5 Account
    May 04, 2017

    Hello Aaron.

     

    Have you enabled the clientside integrity defense checks in your prevention policy? These options do not perform rate limiting but only turns away non-browsers or bots.

     

    Prevention policy methods do not engage simultaneously but in order as long as the attack continues. This could be why it is taking longer to reach the rate limiting options.

     

    You could try removing the integrity check options and if this does not provide the consistency you are looking for please let us know the settings you are using.

     

    • Aaron_Chandra_3's avatar
      Aaron_Chandra_3
      Icon for Nimbostratus rankNimbostratus
      May 05, 2017

      Hello Taunan,

       

      Thanks for replyin.. I didnt enable the integrity defense options and what it have is "source-ip based" and "Url-based" rate limiting... the problem is when it started applying mitigation, it always doin "URL-based" as the top priority, but i thought it will do "source ip based" bcz thats the order.. also most of the time it did detects the attacks and capture in the bruteforce attack log & the log says prevention policy applied:--> "URL based mitigation" but no connection is dropped out /no ip's is in the ip list as well. The version am using is 11.6. dynamic Settings as below

       

      Traffic Detection Criteria Minimum Failed login attempts5Per second Failed login Attempts Increased by500Per second Failed login attempt reached6Per second

       

      suspicious Criteria (Per ip address) Failed Login attempts increased by500 Failed Login attempt rate reached1Per second

       

      Prevention Policy Source Ip-based Rate LimitingTicked URL-based rate limitingTicked

       

      Prevention Duration Unlimited

       

    • nathe's avatar
      nathe
      Icon for Cirrocumulus rankCirrocumulus
      May 05, 2017

      Just to add, it will use the Source IP Based Rate Limiting if the attack meets the Suspicious Criteria (per IP address) thresholds, not the Detection Criteria above, this would trigger the URL based rate limiting...as far as i understand.

       

      So, are you seeing attacks from multiple IP addresses?

       

Related Content