1

Are brute force attacks on public facing interface of internet router normal? Enterprise Router (Cisco) with all hardening done. What can be done to stop this behavior?

6
  • 5
    Attacks are common on everything connected to the internet That's just the way the internet is these days. – Ricky Oct 26 '17 at 4:43
  • What attack are you seeing? Remote SSH, SNMP, NTP should all be denied from the Internet (or restricted to trusted IPs) if you have hardened the configuration – Benjamin Dale Oct 26 '17 at 6:19
  • these are login (ssh) attempts on VTY line. As general implementation, there is an ACL for vty lines and any unauthorized attempt is denied . but SIEM detect the login attempts as failed attempts from public IP's (attack IP's) . is there any way to avoid this. – Inderpreet Singh Oct 26 '17 at 10:59
  • "is there any way to avoid this." Yes, don't connect to the public Internet. That is the way the world works today. The bad guys have automated scripts trying to break into everything. – Ron Maupin Oct 26 '17 at 12:39
  • If you're not interested in those alerts, fix your SIEM so it doesn't report them. – Teun Vink Oct 26 '17 at 13:26
2

Yes. This is why you need to harden any exposed service. Additionally, you might want to monitor potential attack vectors for recurring attacks so you can lock them out completely.

If you haven't been seeing these attacks nowadays you haven't been looking.

To stop these attacks you will have to either stop the attacker (good luck with that) or filter out the traffic when or before it hits the router. We run the WAN link through a switch and filter out known attackers by ACLs.

4
  • When negotiating budgets for internet security, I often show a live log listing of password guessing attempts. Most Finance DIrectors think you'd get one a week and are shocked to see it measured in Hertz, right now in front of their eyes. – jonathanjo Oct 26 '17 at 7:39
  • I tried that and they didn't even believe me - even though it was live as well. "You could be showing as anything." Duh! – Zac67 Oct 26 '17 at 11:24
  • @Zac67 Wow. Time for a new job, maybe. :-0 – Ron Trunk Oct 26 '17 at 11:59
  • No only maybe... – Zac67 Oct 26 '17 at 12:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.