Screen OS

SSG 140 v6.20r4.0

I've set " Maximum Number of Login Failures per Minute" for FTP (Security -> Deep Inspection -> Service Limits)

to prevent brute force attacks on my FTP servers behind the FW.

It doesn't seems to apply. Is there anything I need to do to apply the service limits?

Thanks.

You need to configure DPI on an FTP policy using the FTP-Brute-Force context and then it will look and see the failed attempts and then block for N seconds after Y attempts.

set policy id 1 from "Untrust" to "Foo"  "Any" "ftp-hosts" "FTP" permit
set policy id 1 attack "HIGH:FTP:ANOM" action drop ip-action "block" target "serv" timeout 120

-dsd

Perfect! Thank you!

Hi, is the DI　ｆｕｎｃｔｉｏｎ　ｎｅｅｄ　ｓｐｅｃｉａｌ　ｌｉｃｅｎｓｅ　ｆｏｒ　６．１．ｒ４．０？ Ｔｈａｎｋｓ　ｆｏｒ　ａｎｙ　ａｄｖｉｃｅ