Are brute force attacks on public facing interface of internet router normal? Enterprise Router (Cisco) with all hardening done. What can be done to stop this behavior?

  • 5
    Attacks are common on everything connected to the internet That's just the way the internet is these days.
    – Ricky
    Oct 26, 2017 at 4:43
  • What attack are you seeing? Remote SSH, SNMP, NTP should all be denied from the Internet (or restricted to trusted IPs) if you have hardened the configuration Oct 26, 2017 at 6:19
  • these are login (ssh) attempts on VTY line. As general implementation, there is an ACL for vty lines and any unauthorized attempt is denied . but SIEM detect the login attempts as failed attempts from public IP's (attack IP's) . is there any way to avoid this. Oct 26, 2017 at 10:59
  • "is there any way to avoid this." Yes, don't connect to the public Internet. That is the way the world works today. The bad guys have automated scripts trying to break into everything.
    – Ron Maupin
    Oct 26, 2017 at 12:39
  • If you're not interested in those alerts, fix your SIEM so it doesn't report them.
    – Teun Vink
    Oct 26, 2017 at 13:26

1 Answer 1


Yes. This is why you need to harden any exposed service. Additionally, you might want to monitor potential attack vectors for recurring attacks so you can lock them out completely.

If you haven't been seeing these attacks nowadays you haven't been looking.

To stop these attacks you will have to either stop the attacker (good luck with that) or filter out the traffic when or before it hits the router. We run the WAN link through a switch and filter out known attackers by ACLs.

  • When negotiating budgets for internet security, I often show a live log listing of password guessing attempts. Most Finance DIrectors think you'd get one a week and are shocked to see it measured in Hertz, right now in front of their eyes.
    – jonathanjo
    Oct 26, 2017 at 7:39
  • I tried that and they didn't even believe me - even though it was live as well. "You could be showing as anything." Duh!
    – Zac67
    Oct 26, 2017 at 11:24
  • @Zac67 Wow. Time for a new job, maybe. :-0
    – Ron Trunk
    Oct 26, 2017 at 11:59
  • No only maybe...
    – Zac67
    Oct 26, 2017 at 12:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.