Find the pattern in your VPN authentication logs, protect exposed accounts, and block known sources before they reach the login service.
Start a 14-day free trial Or test 200 entries first: free, no signupPassword spraying is a brute-force technique that tests one password, or a short list of common passwords, against many accounts. It spreads failures across usernames to avoid account lockouts. On a VPN, detect it by correlating authentication failures across sources, users and time, then protect accounts with MFA and access controls.
Free test: download the 200-entry sample. No signup.
MITRE classifies password spraying and credential stuffing as separate brute-force sub-techniques.
| Attack | What the attacker has | Typical pattern | Why it can evade simple limits |
|---|---|---|---|
| Password spraying | One or a few common password guesses | The same guesses across many usernames | Few failures are recorded against each account |
| Brute force (password guessing) | A target username | Many password guesses against that account | Usually it does not: per-account lockout sees the repeated failures |
| Credential stuffing | Username-and-password pairs from an unrelated breach | Each stolen pair is tested on another service | Each account may receive only a small number of tests |
A VPN portal is an externally reachable authentication service. A correct username and password may provide a route into protected resources, which makes exposed remote-access authentication valuable to attackers.
Cisco documents password-spray attacks against ASA and FTD remote-access VPN services. It warns that even unsuccessful attempts can consume firewall resources and prevent valid users from connecting. Palo Alto Networks publishes specific GlobalProtect brute-force signatures and recommends MFA, geographic restrictions, IP blocking and EDL-based policy controls.
The same defensive question applies to GlobalProtect, FortiGate SSL VPN, Cisco Secure Client remote access and SonicWall SSL VPN: which sources are trying which accounts, and did any authentication succeed?
For the broader attack model, see VPN brute force attacks explained.
Correlate by source, username, result and time. A single counter rarely shows the whole campaign.
These are investigation signals, not proof by themselves. NAT can place legitimate users behind one public address. Distributed attackers can also split attempts across many addresses.
| VPN platform | Where to look | Log and signature IDs |
|---|---|---|
| Palo Alto GlobalProtect | Monitor > Logs > GlobalProtect for connection records. Authentication events remain in Monitor > Logs > System. Use Threat logs when the relevant Vulnerability Protection signatures inspect the traffic. | Threat ID 40017 aggregates GlobalProtect authentication requests. Threat ID 40169 tracks failed portal or gateway logons through child signature 96010. |
| FortiGate SSL VPN | FortiOS 7.2 and 7.4: Log & Report > System Events > VPN Events. Earlier 6.2 and 7.0 releases place VPN Events under Log & Report > Events. | SSL VPN login failure log ID 0101039426, description SSL VPN login fail, action ssl-login-fail. Fortinet notes that FortiClient failures can appear with tunnel type ssl-web. |
| Cisco ASA / FTD remote access VPN | Search syslog at informational level 6. Usernames are hidden in these messages by default; Cisco notes that no logging hide username shows them, and that they are then stored in your logs. Cisco also recommends checking show aaa-server for unusual increases in authentication requests and rejects. |
113015 for rejected local-database authentication, 113005 for authentication rejected by an external AAA server and 716039 for rejected WebVPN authentication. |
Apply the free account and portal controls first. Then reduce known hostile traffic at the firewall.
MITRE recommends MFA for externally facing services. MFA means a guessed password alone should not be enough to authenticate. Investigate unexpected prompts and enrollment changes as part of the same incident.
Disable unused accounts and remove VPN access from users who do not need it. Change vendor-default credentials and do not leave authentication enabled on default VPN profiles. Cisco specifically recommends disabling AAA authentication in DefaultWEBVPNGroup and DefaultRAGroup when its newer VPN threat-detection feature is unavailable.
Lockout controls slow repeated guessing, but aggressive values let an attacker deny service to valid users. Review VPN account lockout prevention before lowering thresholds.
login-attempt-limit and login-block-time under config vpn ssl settings. Fortinet's 7.4.1 guide documents defaults of two attempts and 60 seconds. These settings can still contribute to user disruption, so tune them rather than copying values blindly.threat-detection service remote-access-authentication hold-down <minutes> threshold <count> (threshold 1 to 100; Cisco advises higher values when many users share one PAT address) and review tracked sources with show threat-detection service remote-access-authentication entries.Where business requirements permit, allow only expected source networks or regions. Palo Alto Networks and Fortinet both document geographic or source restrictions for their VPN services. Treat location as a filter, not proof of identity.
Client certificates add possession of a managed credential to the login process. Palo Alto Networks and Fortinet document client-certificate authentication for their remote-access VPN products. Plan certificate enrollment, renewal and revocation before enforcing it.
ThreatListPro blocks known sources using a plain-text feed: one IPv4 address or CIDR per line, with individual addresses written as /32. The customer URL format is https://api.threatlistpro.com/v1/YOUR_API_KEY/blocklist.txt. Configure an hourly refresh, or the vendor's nearest option.
Make sure the deny rule covers traffic addressed to the VPN service on the firewall itself. For FortiGate SSL VPN, Fortinet documents a local-in policy, or a VIP and loopback with a firewall policy, for this. The FortiGate and GlobalProtect guides show the exact rule.
The feed covers 5.4M+ IPv4 addresses, is built from real attacks on live production Palo Alto GlobalProtect VPN portals in the US, and is checked for new attackers every 6 hours. Monthly service is $9.99 with a 14-day free trial and no card needed. Yearly service is $100, Enterprise is $49.99/month, and paid plans have a 14-day money-back guarantee.
Open the VPN authentication logs and confirm the source IPs, targeted usernames, failure reasons and time range.
Check whether any targeted account logged in successfully during or after the failures, including from another IP address.
Disable confirmed compromised accounts, reset their credentials and revoke active sessions or tokens in the connected identity system.
Require MFA for every exposed VPN account and investigate unexpected MFA prompts or changes.
Temporarily block the highest-volume source IPs, then add a known-source block list after checking it against trusted user networks.
Export the relevant VPN, firewall and identity logs, record the time zone and retain them for investigation.
For more on rotating infrastructure, see residential proxy VPN attacks. You can also check an address with the IP lookup tool.
| Control | Guessed password alone | Repeated local failures | Known hostile source | New or rotating source |
|---|---|---|---|---|
| MFA | Reduces account-access risk | Attempts can still reach authentication | Still reaches the portal | Still reaches the portal |
| Account or source lockout | Not by itself | Acts after the configured threshold | Only after local failures | Only after local failures |
| Source or geographic restriction | Not by itself | Only outside the allowed scope | Only outside the allowed scope | Only outside the allowed scope |
| Client certificate | Adds a managed credential | Depends on the authentication flow | Still reaches the certificate service | Still reaches the certificate service |
| ThreatListPro block list | Not an account control | Listed IPs are blocked before login | Blocks listed IPv4 sources | Does not block an unlisted source yet |
Password spraying is a brute-force technique that tries one password, or a short list of common passwords, against many accounts. Spreading the attempts across accounts helps the attacker avoid per-account lockout thresholds.
Group failed VPN authentications by source IP, username and time. Look for one source trying many usernames, one username receiving failures from many sources, failures for nonexistent users, and attempts deliberately spaced across the lockout window. Then check whether any targeted account later logged in successfully.
Traditional password guessing commonly tries many passwords against one account. Password spraying reverses the pattern by trying one password, or a small set, against many accounts. Both are brute-force techniques, but spraying is designed to reduce repeated failures against each account.
Password spraying uses common password guesses across many accounts. Credential stuffing uses username-and-password pairs obtained from an earlier breach and tests whether people reused those credentials on another service.
MFA greatly reduces the chance that a guessed password alone results in access, so it should be enabled on every externally facing VPN account. It does not remove the login endpoint or prevent every failed attempt, account lockout or denial-of-service condition.
An IP block list blocks known sources before they reach the VPN login service, as long as the deny rule covers traffic addressed to the VPN service on the firewall itself (on FortiGate SSL VPN, a local-in policy). It does not stop a new IP's first attempt, IPv6 traffic, or every rotating residential proxy. Use it with MFA, restricted access, sensible lockout controls and monitoring.
Use one plain-text feed URL in your firewall. 5.4M+ IPv4 addresses, checked for new attackers every 6 hours. Monthly service is $9.99 with a 14-day free trial and no card needed.
Start a 14-day free trial Or test 200 entries first: free, no signupThreatListPro provides a standard IP blocklist feed compatible with firewalls that support external lists.
Continue with the platform guide or incident pattern that matches what you found.