Meraki

JNetworkMan05

Hello, I tried the Layer 7 firewall rule and it seems to have not worked (same errors this morning with the failed VPN logins). Reading into your second suggestion now.

JNetworkMan05

This is where another piece of the puzzle gets tricky. It appears as though there is some sort of proxy path directing these and the source of the IP is the same IP as my "transit to Nexus" VLAN interface IP.

JNetworkMan05

This makes sense. The problem is, all of these failed attempts aren't my users. They are just random names. So while the function of the Meraki is failing their login attempts by design, I am concerned by how often this is happening.

JNetworkMan05

Noticed a weird event while going through my Event logs on one of my MX firewalls. I am getting an AnyConnect VPN authentication failure with details stating "msg: SAML: SSO token verify failure for user: " and then for the user its just random names (just one name, first letter and last name, first and last name, etc. Tracking down the IP leads me to the same IP that I am assuming is a proxy path coming from the internet? Has anyone else experienced this issue? I am getting over 200 failed attempts per day and am worried that I should be doing something else to prevent these from even attempting to login?

Meraki

Community

About JNetworkMan05

JNetworkMan05

Community Record

Badges

Re: SSO Token Failure Traffic

Re: SSO Token Failure Traffic

Re: SSO Token Failure Traffic

SSO Token Failure Traffic