Security

Hi,<br>I would like to implement the blacklist for users in public captive portal using ClearPass guest, to prevent brute force attacks, anyone know how?<br>Thanks

At the Virtual AP level under advanced, you would enable "Station Blacklisting" (the master switch).  You would also configure the authentication failure blacklist time, which says how long the user would not be able to associate (Zero would be permanent).

 

In the Captive Portal Authentication Profile, you would also configure "Max Authentication Failures" which would indicate how many times the user would have to fail authentication before they are blacklisted (zero turns off blacklisting).

 

Many thanks Colin for the fast answer.
I forgot tell that we are using Instant AP with External Captive Portal from Clearpass, it would be the same?
Thanks.

It is different for Instant.

 

Please see here:  http://www.arubanetworks.com/techdocs/Instant_40_WebHelp/InstantWebHelp.htm#UG_files/Authentication/DynamicBlacklist.htm?Highlight=blacklist

 

Thanks! I thought it would be different when use an external portal. :smileywink: