GlobalProtect Brute Force Protection

Recognize attack patterns in your PAN-OS logs, tune Threat ID 40017, and deploy an EDL blocklist to stop VPN brute force attacks on your GlobalProtect portal.

Start Blocking Attacks — 30-Day Free Trial
~1,600
Curated Blocklist IPs
40017
PAN-OS Threat ID for Brute Force
5 min
EDL Setup Time

Are You Under Attack Right Now?

If you're seeing these events in your PAN-OS logs, your GlobalProtect portal is being targeted by brute force bots. Here's how to confirm and respond.

System Log: Repeated auth-fail Events

Open Monitor > Logs > System and filter for subtype eq globalprotect. If you see hundreds of auth-fail entries from different source IPs, you are under active brute force attack.

// PAN-OS System log — GlobalProtect brute force indicators
2026-04-17 03:14:22 auth-fail globalprotect portal-auth src=185.220.101.34 user=admin reason="Invalid credential"
2026-04-17 03:14:25 auth-fail globalprotect portal-auth src=92.118.36.210 user=administrator reason="Invalid credential"
2026-04-17 03:14:27 auth-fail globalprotect portal-auth src=45.134.26.19 user=vpnuser reason="Invalid credential"
2026-04-17 03:14:31 auth-fail globalprotect portal-auth src=194.26.29.102 user=admin reason="Invalid credential"
// Pattern: different source IPs, common usernames, rapid succession

Threat Log: Threat ID 40017 Alerts

Check Monitor > Logs > Threat and filter for threatid eq 40017. This is Palo Alto's built-in brute force detection signature. If it's firing, a single IP has exceeded the failed-login threshold (default: 10 attempts in 60 seconds).

// PAN-OS Threat log — Threat ID 40017 trigger
2026-04-17 03:15:01 THREAT 40017 "Brute Force" src=185.220.101.34 dst=10.0.1.1 action=alert severity=medium
// Default action is alert-only — it does NOT block the attacker
The default is alert-only. PAN-OS Threat ID 40017 generates alerts but does not block attackers by default. You need to change the action to reset-both or drop in your Vulnerability Protection profile. See the tuning section below.

Active Directory: Mass Account Lockouts

Brute force attacks trigger AD account lockout policies. If your helpdesk is seeing 50+ accounts locked per day — especially accounts like admin, administrator, vpnuser, and real employee usernames — the cause is almost certainly external brute force against your GlobalProtect portal, not internal users forgetting passwords.

How GlobalProtect Portals Get Attacked

GlobalProtect VPN portals are publicly reachable by design. Attackers run automated credential campaigns against them 24/7 using three main techniques.

Credential Stuffing

Attackers take username/password pairs leaked from data breaches and try them against your VPN portal. If any employee reuses a password from a breached site, the attacker gets in.

  • Uses real leaked credentials, not random guesses
  • Success rate: 0.1–2% of attempts
  • Typically 10,000+ attempts per campaign

Password Spraying

Instead of many passwords against one user, the attacker tries a small set of common passwords against many usernames. This stays under per-user lockout thresholds.

  • Tries "Summer2026!", "Company123" against all users
  • 1–3 attempts per user to avoid lockout
  • Cycles through your entire user directory

Distributed Brute Force

Modern attacks use thousands of source IPs (botnets or residential proxies). Each IP sends only 2–5 attempts, staying under per-IP detection thresholds like Threat ID 40017.

  • 10,000+ unique source IPs in a single campaign
  • Per-IP rate limiting doesn't work
  • Requires aggregate-level detection

Username Enumeration

GlobalProtect portals may return different error messages for "user not found" vs "wrong password." Attackers use this to build a list of valid usernames before launching the real attack.

  • Probing phase before the main attack
  • Valid usernames are sold to other attackers
  • Fix: normalize error messages in GP config

Tuning PAN-OS Threat ID 40017

Threat ID 40017 detects per-IP brute force attempts. Here's how to tune it from alert-only to active blocking — and why it's not enough on its own.

01

Open Your Vulnerability Protection Profile

Navigate to Objects > Security Profiles > Vulnerability Protection. Select the profile applied to your GlobalProtect security rule (or create a new one).

02

Find and Edit Threat ID 40017

Click Exceptions, then Show All Signatures. Search for 40017. Click the entry to edit it. Change the Action from default (alert) to reset-both. This kills the TCP session on both sides when brute force is detected.

03

Tune the Threshold (Optional)

Default threshold: 10 failed attempts in 60 seconds from one IP. For GlobalProtect, consider lowering to 5 attempts in 120 seconds. This catches slower attackers while still allowing legitimate users who mistype their password.

04

Apply and Commit

Ensure the Vulnerability Protection profile is attached to the security rule that handles your GlobalProtect traffic. Commit the configuration.

Limitation: Threat ID 40017 only detects brute force from a single source IP. Distributed attacks using thousands of IPs — each sending only 2–3 attempts — will never trigger it. That's why you need an EDL blocklist as your first line of defense.

EDL Setup — Block Known Attackers in 5 Minutes

Add ThreatListPro's curated VPN brute force blocklist as an External Dynamic List on your PAN-OS firewall.

01

Create Your ThreatListPro Account

Sign up at threatlistpro.com and copy your unique feed URL from the dashboard. It looks like:
https://feed.threatlistpro.com/v1/edl/YOUR_API_KEY

02

Add the External Dynamic List in PAN-OS

Navigate to Objects > External Dynamic Lists. Click Add. Set the name to ThreatListPro-VPN, type to IP List, and paste your feed URL. Set the repeat interval to 5 minutes.

03

Create a Security Policy Rule

Go to Policies > Security and add a new rule. Set the source zone to Untrust, source address to the EDL object ThreatListPro-VPN, destination to your GlobalProtect interface, and action to Deny. Place this rule above your existing allow rules.

04

Commit and Verify

Commit the configuration. Navigate to Objects > External Dynamic Lists, select the list, and click Test Source URL to verify IPs are loading. Check the Traffic log to confirm blocks are occurring.

DAG + EDL Stacking: Complete Defense

Combine a pre-built blocklist (EDL) with real-time local detection (Dynamic Address Group) for layered protection that handles both known and unknown attackers.

Layer 1: EDL (Proactive)

The ThreatListPro EDL blocks ~1,600 known VPN brute force IPs before they even connect. These are IPs confirmed attacking VPN portals worldwide. The traffic is dropped at the network layer — no CPU spent on TLS handshakes or login processing.

Layer 2: DAG (Reactive)

A Dynamic Address Group auto-tags source IPs that trigger Threat ID 40017 on your firewall. These are new attackers not yet in any blocklist. Once tagged, they're automatically added to a block rule — no manual intervention needed.

How to Configure DAG Auto-Tagging

This PAN-OS configuration creates a feedback loop: Threat ID 40017 detects brute force → auto-tags the source IP → DAG membership updates → block rule applies instantly.

# Step 1: Create the tag
Objects > Tags > Add: brute-force-attacker

# Step 2: Create the Dynamic Address Group
Objects > Address Groups > Add:
  Name: DAG-BruteForce-Block
  Type: Dynamic
  Match: 'brute-force-attacker'

# Step 3: Create a Log Forwarding Profile with auto-tagging
Objects > Log Forwarding > Add:
  Name: AutoTag-BruteForce
  Log Type: Threat
  Filter: (threatid eq 40017)
  Built-in Actions > Add Tagging:
    Target: Source Address
    Action: Add Tag
    Tag: brute-force-attacker
    Registration: Local
    Timeout: 3600 (1 hour — adjust to your needs)

# Step 4: Create a Security Rule using the DAG
Policies > Security > Add:
  Name: Block-BruteForce-DAG
  Source Zone: Untrust
  Source Address: DAG-BruteForce-Block
  Action: Deny
  // Place above your GP allow rule, below the EDL block rule
Rule order matters. Place your rules in this order: (1) EDL block rule (ThreatListPro), (2) DAG block rule (auto-tagged IPs), (3) GlobalProtect allow rule. The EDL catches known attackers instantly. The DAG catches new attackers after their first burst. Only clean traffic reaches your login page.

Defense Approaches Compared

Each approach handles a different part of the problem. The recommended strategy stacks all three.

CapabilityThreatListPro EDLThreat ID 40017DAG Auto-TagMFA
Blocks known attackers
Detects new attackers in real-time
Stops distributed attacks
Prevents credential reuse
Reduces log noise
Prevents AD lockouts
Setup time5 min10 min15 minWeeks
Ongoing maintenanceNone (auto-updates)NoneNoneUser enrollment

Frequently Asked Questions

How do I know if my GlobalProtect portal is under brute force attack?

Check your PAN-OS System logs for repeated auth-fail events from many different source IPs against your GlobalProtect portal. Look for Threat ID 40017 in your Threat logs. Common signs include hundreds of failed login attempts per hour, authentication failures from IPs in countries where you have no employees, and Active Directory account lockouts caused by external login attempts.

What is PAN-OS Threat ID 40017?

Threat ID 40017 is Palo Alto's built-in brute force detection signature. It triggers when a single source IP exceeds a threshold of failed login attempts (default: 10 in 60 seconds). You can tune the threshold and action under Objects > Security Profiles > Vulnerability Protection. It detects per-IP brute force but misses distributed attacks from many IPs.

What is EDL + DAG stacking?

EDL + DAG stacking combines an External Dynamic List (pre-built blocklist of known attacker IPs) with a Dynamic Address Group (auto-tagging IPs that trigger local brute force detection). The EDL blocks known attackers before they connect. The DAG catches new attackers in real time. Together, they provide both proactive and reactive defense.

How do I add an External Dynamic List (EDL) to my Palo Alto firewall?

In PAN-OS, navigate to Objects > External Dynamic Lists, click Add, set the type to IP List, and paste your ThreatListPro feed URL. Set the refresh interval to 5 minutes. Then reference this EDL in a Security Policy rule to block inbound traffic from those IPs to your GlobalProtect portal.

Does ThreatListPro work with PAN-OS 10 and PAN-OS 11?

Yes. ThreatListPro serves a standard plaintext IP list compatible with all PAN-OS versions that support External Dynamic Lists, including PAN-OS 9.x, 10.x, and 11.x. No special configuration or minimum version is required.

How often does ThreatListPro update its blocklist?

ThreatListPro updates its curated VPN brute force blocklist weekly. The list contains approximately 1,600 high-confidence attacker IPs verified through behavioral correlation across thousands of VPN sensors worldwide. Your Palo Alto firewall can refresh the EDL as frequently as every 5 minutes.

Protect Your GlobalProtect Portal Now

Join hundreds of network admins who block VPN brute force attacks automatically. 30-day free trial, no credit card required.

Start Free Trial — $9.99/mo

Works With All Major Firewalls

ThreatListPro provides a standard IP blocklist feed compatible with any firewall that supports external lists.

Palo Alto FortiGate pfSense OPNsense SonicWall Cisco ASA Sophos XG UniFi

Related Resources

Learn more about IP blocklists, VPN security, and advanced defense strategies.

VPN Brute Force Attacks Explained What Is an External Dynamic List (EDL)? IPv6 VPN Brute Force: The Emerging Blind Spot Residential Proxy VPN Attacks Explained Stop Account Lockouts from Brute Force Best IP Blocklist Stack 2026 Best VPN Brute Force Protection 2026 All Firewall Setup Guides