Blocking access attempts prior to authentication attempt on 10443 for known bad actors.

[pm238]

Newbie question: I have a client that I monitor who is getting a number of requests from specific TOR exit nodes to the SSLVPN server 10443. There is a small exchange of data each time. Two questions.

Is there a way to block this traffic before the authentication attempt starts? Can firewall policy supersede the auth attempt? 

Are there any other best practices around blocking TOR traffic (with regards to this port).

Thanks in advance for any help.

pm238

[ede_pfau]

Yes, both Local-In policy and DDoS policy are able to block rogue sources.

Alas, not all features available in a regular policy are usable in these, but source address, destination address and port are. YMMV.

Configure Local-In policies in the CLI. I find the GUI feature (after activation) less useful.

[pm238]

Thanks, Ede. This was just what I was looking for. I truly appreciate it.