Fail2ban-style protection for FortiGate, Palo Alto, SonicWall, MikroTik, Linux, and Windows servers.
Compare the built-in controlsIt depends on the platform. FortiGate SSL VPN blocks a source IP after 2 failed attempts by default. SonicOS can lock out a login IP once you enable it. Palo Alto locks users, or blocks an IP only after you configure a brute-force signature. MikroTik needs firewall rules, Linux can use Fail2Ban, and Windows locks accounts, not IPs.
Testing a block list? Download the free 200-entry sample. No signup is required.
Check what is counted before changing a threshold. Some controls lock a user account. Others block the source IP.
| Vendor | Built-in control | Tracks | Default | Where configured | Limit |
|---|---|---|---|---|---|
| FortiGate | SSL VPN login-attempt-limit and login-block-time |
Source IP | 2 failed attempts; 60-second window and block | config vpn ssl settings |
0–10 attempts; 0–86,400 seconds |
| FortiGate | Administrative login lockout | Administrator login | 3 attempts; 60 seconds | config system global |
Protects FortiGate administration, not a VPN user login |
| Palo Alto | Authentication Profile lockout | User account | Failed Attempts 0 (unlimited, so no lockout) in normal mode; 10 in FIPS-CC mode | Device > Authentication Profile > profile > Advanced | 0–10 attempts; 0–60 minutes; not available for SAML |
| Palo Alto | GlobalProtect failed-logon signature 40169 with Block IP |
Source or source-and-destination | Signature action is Alert | Objects > Security Profiles > Vulnerability Protection > Exceptions | Block duration 1–3,600 seconds |
| SonicWall | Admin/user lockout with login-IP lockout selected | Source IP, or local account if local account lockout is selected | Off; when enabled, 5 failed attempts in 5 minutes and a 5-minute lockout | Device > Settings > Administration > Login / Multiple Administrators | 1–99 attempts; 1–240-minute attempt window; 0–60-minute lockout |
| MikroTik | Firewall address-list staging rules | New connections from a source IP | No preset rule | /ip firewall filter |
Counts connections, not authentication results; rules and timeouts are administrator-defined |
| Linux | Fail2Ban jail, filter, and firewall action | Source IP found in matching logs | Depends on the installed package and jail | Fail2Ban configuration under /etc/fail2ban |
Only services whose logs and filters are configured |
| Windows Server | Account Lockout Policy | User account | Default domain policy: 0 invalid attempts | Computer Configuration > Windows Settings > Security Settings > Account Policies > Account Lockout Policy | 0–999 attempts; does not create an automatic RDP source-IP firewall ban |
Use the native SSL VPN and administrator controls first. They protect different login surfaces.
Fortinet documents a default login-attempt-limit of 2 and a default login-block-time of 60 seconds. The block time is also the window in which attempts are considered consecutive. A value of 0 disables the corresponding limit.
config vpn ssl settings
set login-attempt-limit 2
set login-block-time 60
endOn FortiOS 7.2.6 and later, 7.4.1 and later, and 7.6.x, inspect the temporary list with diagnose vpn ssl blocklist list. See the FortiGate failed-login guide for log messages, reset commands, SAML behavior, and version details.
Administrative access has separate global controls. Fortinet documents defaults of three failed attempts and 60 seconds. These settings do not replace the SSL VPN controls above.
config system global
set admin-lockout-threshold 3
set admin-lockout-duration 60
endAlso restrict administrative access with trusted hosts and local-in policy where appropriate. Do not expose management access merely to make remote administration convenient.
FortiOS 7.6.3 documents diagnose user banned-ip for listing, adding, deleting, and clearing banned addresses. Manual addition requires an address, expiry, and source category:
diagnose user banned-ip add <src4 | src6> <address> <expiry> adminFortinet's guide does not state the expiry unit, so check the CLI help on your build. An expiry of 0 means the ban does not expire.
Fortinet documents event-log triggers for automation stitches and an IP Ban action for specific supported triggers. Its FortiOS 7.6.1 trigger reference limits the built-in IP Ban action to the Compromised Host trigger. It does not document a direct SSL VPN failed-login event-to-IP-Ban stitch, so this page does not present one as a supported recipe.
Authentication Profile lockout is per user. Vulnerability Protection can block a source address after a signature triggers.
For PAN-OS 11.2, open Device > Authentication Profile > profile > Advanced. Failed Attempts accepts 0 through 10. Lockout Time accepts 0 through 60 minutes. In normal operational mode both default to 0. A Failed Attempts value of 0 means unlimited attempts, so nothing locks until you set it; a Lockout Time of 0 keeps the account locked until an administrator unlocks it. These fields apply to authentication types other than SAML.
This control follows the user account. It does not ban every connection from the source IP.
Use Threat ID 40169 when the concern is GlobalProtect failed logons only. Palo Alto Networks documents it as a medium-severity signature with a default action of Alert.
Go to Objects > Security Profiles > Vulnerability Protection. Edit the profile, open Exceptions, show all signatures, find 40169, enable its exception, and set the action to Block IP. Track by source or source-and-destination and set a duration from 1 to 3,600 seconds. Attach that profile to the GlobalProtect security rule under Policies > Security > rule > Actions > Profile Setting, then commit.
40017 triggers after 10 GlobalProtect authentication requests from one source to one destination in 60 seconds by default. Its child signature counts authentication requests, not failed logons only. Use 40169 when failed logons are the intended signal.
SonicOS 7 can use either source-IP lockout or local account lockout. Confirm which mode is selected.
Go to Device > Settings > Administration > Login / Multiple Administrators and enable Admin/user lockout. Leave Enable local admin/user account lockout (uncheck for login IP address lockout) unchecked when the goal is to lock the source IP.
Admin/user lockout is off by default. When enabled, the SonicOS 7.1 guide documents defaults of five failed attempts in five minutes and a five-minute lockout. The attempt threshold accepts 1 through 99, the attempt window 1 through 240 minutes, and the lockout period 0 through 60 minutes. A lockout period of 0 is permanent.
The local account option applies only to locally authenticated users. Configure lockout at LDAP, Active Directory, RADIUS, TACACS+, or another identity provider when that provider performs authentication.
SonicWall's guide describes administrator and user logins to the appliance. It does not say whether login-IP lockout also counts SSL VPN client logins, so test it with one non-production address before relying on it for the VPN.
RouterOS can stage repeated new connections through address lists, but these rules do not know whether a password was correct.
MikroTik’s documented SSH example moves a source through three temporary lists and then adds it to a one-day blacklist. It applies to services on the router because it uses the input chain. Adapt the destination port only after confirming the service and preserving a trusted management path.
/ip firewall filter
add action=add-src-to-address-list address-list=bruteforce_blacklist address-list-timeout=1d chain=input comment=Blacklist connection-state=new dst-port=22 protocol=tcp src-address-list=connection3
add action=add-src-to-address-list address-list=connection3 address-list-timeout=1h chain=input comment="Third attempt" connection-state=new dst-port=22 protocol=tcp src-address-list=connection2
add action=add-src-to-address-list address-list=connection2 address-list-timeout=15m chain=input comment="Second attempt" connection-state=new dst-port=22 protocol=tcp src-address-list=connection1
add action=add-src-to-address-list address-list=connection1 address-list-timeout=5m chain=input comment="First attempt" connection-state=new dst-port=22 protocol=tcp
add action=accept chain=input dst-port=22 protocol=tcp src-address-list=!bruteforce_blacklistMikroTik warns that SSH permits multiple login attempts per connection and that a successful login does not clear these address lists. An administrator can blacklist their own address. The last rule only accepts sources that are not blacklisted, so a later drop rule in the input chain is what actually refuses blacklisted sources. See the MikroTik protection guide instead of copying these SSH rules blindly to a VPN service.
Server controls work from local authentication evidence. They are different from a firewall’s VPN login controls.
Fail2Ban monitors configured log sources, matches authentication failures with a filter, and runs ban and unban actions. The project documents firewall-rule actions that reject new connections from matching IP addresses for a configurable period.
Use a jail supplied for your service or write and test a service-specific filter. Do not assume a generic SSH jail can parse a VPN product’s logs. See ThreatListPro vs. Fail2Ban and the SSH brute-force protection guide.
Configure Computer Configuration > Windows Settings > Security Settings > Account Policies > Account Lockout Policy. Microsoft documents a threshold range of 0 through 999 failed sign-ins. A threshold of 0 means the account is never locked by this policy.
The policy locks the user account. It does not add the RDP client’s address to Windows Defender Firewall. Use the RDP brute-force protection guide for RDP-specific controls and monitoring.
Reactive rules need the same source or user to reach a threshold. Modern guessing can stay below it.
Password spraying tries a small number of common passwords against many accounts. Microsoft documents low-and-slow attacks in which account-lockout and bad-password thresholds are not reached, and attacks that use multiple source IP addresses.
A strict user lockout can also deny access to a real user when an attacker deliberately submits bad passwords for that account. A strict source-IP block can affect many users behind the same NAT address.
Keep MFA, strong authentication, access restrictions, vendor-native rate controls, and monitoring in place. See why password spraying evades simple thresholds.
Use a list when known attacker addresses are too numerous to maintain by hand and you want to block them before another login attempt.
A dynamic block list (Palo Alto calls it an External Dynamic List, or EDL; FortiGate calls it a threat feed) lets a compatible firewall retrieve addresses from a URL. See what an external dynamic list is for the details.
ThreatListPro covers 5.4M+ IPv4 addresses. It is built from real attacks on live production Palo Alto GlobalProtect VPN portals in the US and is checked for new attackers every 6 hours.
The feed is plain text with one IPv4 address or CIDR per line. Single IPs are written as /32. Configure an hourly refresh or the firewall vendor’s nearest available option. Use the existing Palo Alto setup guide, FortiGate setup guide, or MikroTik setup guide rather than treating this reference page as a deployment procedure.
A new IP’s first attempt still arrives. ThreatListPro is IPv4 only, and it does not stop every brute-force or password-spraying attempt. CIDR ranges include addresses that did not each attack, so check your users’ source IPs first and allow-list trusted networks where needed.
A list does not replace MFA, current software, secure authentication policy, login monitoring, or incident response.
Layer controls according to the event they can actually observe.
| Control | Repeated attempts from one IP | One account attacked from many IPs | Low-and-slow password spraying | Known attacker before first local attempt |
|---|---|---|---|---|
| Source-IP threshold | Yes, after the threshold | Only when an individual IP reaches the threshold | Often missed | No |
| User account lockout | Protects the account after the threshold | Yes, but can deny service to the real user | Often missed when each account stays below threshold | No |
| MFA or certificate authentication | Reduces the value of a guessed password | Reduces the value of a guessed password | Reduces the value of a guessed password | Does not block the connection by itself |
| Dynamic block list | Blocks listed sources before authentication | Blocks each listed source | Blocks sources already on the list | Yes, for listed IPv4 sources |
| Monitoring and incident response | Finds patterns and validates impact | Correlates activity across sources | Can correlate low-volume distributed activity | Provides investigation, not preemptive blocking |
For SSL VPN, configure login-attempt-limit and login-block-time under config vpn ssl settings. The documented defaults are two failed attempts and a 60-second block. Administrative login uses separate admin-lockout-threshold and admin-lockout-duration settings under config system global.
Fail2Ban is a server program, not a FortiGate package. FortiGate has native source-IP limits for SSL VPN and separate administrator lockout controls. It can also consume a remote threat feed when the address list is too long to maintain manually.
No automatic IP ban should be assumed. GlobalProtect brute-force signatures default to Alert. To block an address, configure a Vulnerability Protection exception with Block IP, choose source or source-and-destination tracking, set the duration, attach the profile to the applicable security rule, and commit.
In SonicOS 7, open Device > Settings > Administration > Login / Multiple Administrators and enable Admin/user lockout, which is off by default. Leave the local account lockout option unchecked for login-IP lockout. Check for shared NAT addresses first because other users, including an administrator, can share the blocked source IP.
Use the VPN firewall’s native failed-login control first. Add MFA and access restrictions. For known attacker addresses, a compatible firewall can retrieve a dynamic block list and deny those sources before authentication. This complements reactive controls; it does not replace them or stop every new source.
The control may be tracking users while you expect source IPs, or counting connections rather than failed passwords. SAML or an external identity provider may own the lockout decision. Password spraying can also spread a few attempts across many accounts and IP addresses so no individual threshold is reached.
ThreatListPro covers 5.4M+ IPv4 addresses and is checked for new attackers every 6 hours. Monthly service is $9.99 with a 14-day free trial and no card needed.
Start a 14-day free trial Or test 200 entries first: free, no signupUse the platform-specific guide when you are ready to configure the feed and firewall policy.
Continue with the platform-specific response and hardening guides.