Are brute force attacks on public facing interface of internet router normal? Enterprise Router (Cisco) with all hardening done. What can be done to stop this behavior?
asked Oct 26, 2017 at 4:38
-
5Attacks are common on everything connected to the internet That's just the way the internet is these days.– RickyCommented Oct 26, 2017 at 4:43
-
What attack are you seeing? Remote SSH, SNMP, NTP should all be denied from the Internet (or restricted to trusted IPs) if you have hardened the configuration– Benjamin DaleCommented Oct 26, 2017 at 6:19
-
these are login (ssh) attempts on VTY line. As general implementation, there is an ACL for vty lines and any unauthorized attempt is denied . but SIEM detect the login attempts as failed attempts from public IP's (attack IP's) . is there any way to avoid this.– Inderpreet SinghCommented Oct 26, 2017 at 10:59
-
"is there any way to avoid this." Yes, don't connect to the public Internet. That is the way the world works today. The bad guys have automated scripts trying to break into everything.– Ron Maupin ♦Commented Oct 26, 2017 at 12:39
-
If you're not interested in those alerts, fix your SIEM so it doesn't report them.– Teun VinkCommented Oct 26, 2017 at 13:26
|
Show 1 more comment
1 Answer
Yes. This is why you need to harden any exposed service. Additionally, you might want to monitor potential attack vectors for recurring attacks so you can lock them out completely.
If you haven't been seeing these attacks nowadays you haven't been looking.
To stop these attacks you will have to either stop the attacker (good luck with that) or filter out the traffic when or before it hits the router. We run the WAN link through a switch and filter out known attackers by ACLs.
-
When negotiating budgets for internet security, I often show a live log listing of password guessing attempts. Most Finance DIrectors think you'd get one a week and are shocked to see it measured in Hertz, right now in front of their eyes. Commented Oct 26, 2017 at 7:39
-
I tried that and they didn't even believe me - even though it was live as well. "You could be showing as anything." Duh!– Zac67 ♦Commented Oct 26, 2017 at 11:24
-
-