> Source: [sk180271](https://support.checkpoint.com/results/sk/sk180271) # sk180271 - VPN SNX portal may be vulnerable to brute-force attack on passwords | Property | Value | |----------|-------| | Solution ID | sk180271 | | Date Created | 2022-11-13 | | Last Modified | 2026-01-21 | | Technical Level | General | | Products | Security Gateway | | Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) | | OS | Gaia | ## Symptoms - The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured for username/password authentication, it is vulnerable to a brute-force attack on usernames and passwords. ## Cause The VPN SNX portal in the IPsec VPN Software Blade does not implement any protection against brute-force attack on usernames/passwords. ## Solution ### Note: This SK is explicitly for VPN SNX. SSL VPN (MAB and SNX) will have different limitations than VPN Tunnel mode. ### Overview The protection for the VPN SNX Portal behaves in this way: * Each failed authentication attempt in the VPN SNX Portal triggers a delay (the default delay is 3 seconds). * If a client IP address fails to authenticate in the VPN SNX Portal several times in a row, the protection bans the client IP address for a specific period of time. The default is 3 failed login attempts in a row. The default ban duration is 5 minutes. The protection is included starting from: * [Check Point R81.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk173903) * [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 79 * [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 77 * [Jumbo Hotfix Accumulator for R80.40](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.40/Default.htm) starting from Take 180 * [Jumbo Hotfix Accumulator for R80.30SP](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165312) - Starting from Take 108 * [Jumbo Hotfix Accumulator for R80.30](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.30/Default.htm) starting from Take 255 * [Jumbo Hotfix Accumulator for R80.20SP](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk155832) - planned for the next Take (ETA is 29 Dec 2022, subject to change) * [Jumbo Hotfix Accumulator for R80.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.20/Default.htm) starting from Take 230 Notes: * Before the fix for the VPN SNX Portal is integrated into the Jumbo Hotfix Accumulators for the R80.20SP / R80.30SP versions, [contact Check Point Support to get a hotfix](https://www.checkpoint.com/support-services/contact-support/) for these two versions. * Check Point recommends to always upgrade to the [recommended version](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk95746) ([Security Gateway](https://support.checkpoint.com/product/73) / [VSX](https://support.checkpoint.com/product/359)). ### Configuration * The VPN SNX Portal protection is enabled by default. * You can control some protection aspects of this protection with kernel parameters on the Security Gateway. **Note** - For instructions for configuring kernel parameters, see the [Quantum Security Gateway Guide](https://support.checkpoint.com/product/73) for your version \> Chapter "Working with Kernel Parameters" \> Section "Firewall Kernel Parameters". |------------------------------------------|-------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Kernel Parameter | Valid Values | Description | | *vpn_failed_auth_delay_seconds* | * 0 * \ | Controls the delay before accepting the next login attempt from a specific IP address: * 0 - Disables the feature (not recommended) * Any positive integer - Configures the delay (in seconds) before accepting the next login attempt from a specific IP address * Default - 3 seconds | | *vpn_failed_auth_attempt_threshold* | * \ | Controls the number of failed authentication attempts (after how many consecutive login attempts, the SNX portal stops accepting the login attempts from a specific IP address): * Any positive integer - Configures the number of failed login attempts * Default - 3 failed attempts | | *vpn_brute_force_attack_penalty_seconds* | * 0 * \ | Controls the ban penalty period for a failed authentication attempt (for how long the SNX portal stops accepting login attempts from a specific IP address): * 0 - Disables the ban penalty period (not recommended) * Any positive integer - Configures the ban penalty period (in seconds) * Default - 300 seconds (5 minutes) * Note - This feature protects only SNX Portal and SNX CLI. | ### Removing a client IP address from an active ban 1. Connect to the command on the Security Gateway. 2. Log in to the Expert mode. 3. Run: `vpn snx_unban ` Example: `vpn snx_unban 192.168.22.33` --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content