See anyconnect usernames in the log (good for brute force attackes)
Once / Append
no loggin hide username
Disable CSD (related to AnyConnect posture)
Every time / Append
tunnel-group DefaultWEBVPNGroup webvpn-attributes
without-csd
VPN idle policy
Once / Append
group-policy .DefaultS2SGroupPolicy attributes
vpn-idle-timeout none
vpn-session-timeout none
Control plane ACL
Once / Append
access-group $Anyconnect_Block_Bad in interface OUTSIDE control-plane
Enable threat detection
Every time / Append
threat-detection service invalid-vpn-access
threat-detection service remote-access-client-initiations hold-down 10 threshold 20
threat-detection service remote-access-authentication hold-down 10 threshold 20
Disable AnyConnect webpage
Once / Append
webvpn
keepout "503: Service Unavailable"
Enable AnyConnect webpage
Once / Append
webvpn
no keepout "503 Service Unavailable"
No comments:
Post a Comment