Forum Discussion

Canan_374222's avatar
Canan_374222
Icon for Nimbostratus rankNimbostratus
Mar 19, 2019

User gets blocking page instead of captcha during brute force attack

Hello everyone, I want to mitigate brute force captcha to Exchance OWA. However, user gets blocking page instead of captcha during brute force attack. Although I created brute force protection configuration as alarm and captcha mitigation, in the blocked request, I see that the reason for blocking page is brute force attack with alarm and blocking page mitigation. Have you encountered the same problem before or does anyone know what should be done in that case?

 

Some informations about my policy are listed below:

 

  1. Brute force is configured with alarm and captcha mitigation.
  2. The only source configured is username.
  3. My login page is /owa/auth.owa.
  4. Authentication Type is HTML Form.
  5. Username Parameter Name is username and Password Parameter Name is password.
  6. Expected HTTP response status code is 302.
  7. F5 version is 14.0.0.2
  8. My security policy is created with Exchance 2016 template.

Best regards, Canan

 

2 Replies

  • Hi Canan,

     

    Fortunately, I am familiar with this issue. You need to qualify the URL as a login page. You must log into the command line and run the command: tmsh modify /sys db asm.cs.qualified_urls value /loginpage.mvc

     

    This should fix your problem. Let me know if it works for you!

     

    • Bobow's avatar
      Bobow
      Icon for Cirrus rankCirrus

      Hi Jacob,

       

      there is no impact on system?

      What the command if we want to revert back after do command "tmsh modify /sys db asm.cs.qualified_urls value /loginpage.mvc" ?

       

      Thanks