SSL VPN issues on my E61

[crp0499-onsite]

So, I have an E61 firewall and it's got a nice SSL VPN on it for my 10 or so users who are in other countries.  These users connect and we are using an LDAP integration for authentication.

Today, I found out that people are trying to access the SSL VPN using real usernames from the org, and when they enter the wrong password three times, the user is locked out of Active Directory.

For now, the SSL VPN is disabled.

I need a solution for this.  

My first thought is to get some tokens and enable 2FA.

Can some of you experts make some suggestions about how to best mitigate this?

Thanks

[Toshi_Esumi]

This is Googles answer when I searched with "windows AD lockout after three failed attempts". You can get the same yourself.

AI Overview

In a Windows Active Directory (AD) environment, a user account will typically be locked out after three failed login attempts, meaning if someone enters the wrong password three times in a row, their account will be temporarily blocked from accessing the system; this is considered a standard setting to prevent brute-force password attacks. 

Key points about AD account lockouts:

Threshold setting:

The number of failed attempts before lockout is customizable through Group Policy and is often set to "3" as a default. 

Security measure:

Account lockouts are a crucial security feature to prevent unauthorized access by automatically blocking accounts after multiple incorrect password attempts. 

How to manage account lockout settings:
Access Group Policy:

Navigate to "Computer Configuration > Windows Settings > Security Settings > Account Policies > Account Lockout Policy" to modify the lockout threshold and duration. 

Considerations:

Setting the threshold too low can lead to accidental lockouts due to typos, while setting it too high might allow attackers more attempts to guess the password. 

Toshi

[crp0499-onsite]

Thank you Toshi. 

[crp0499-onsite · Accepted solution]

I opened a ticket with FG and they recommended the dialup SSL VPN using a preshared key.

I opted for 40 tokens and turning on 2FA.