How To: Enable Dynamic IP Blocking

Version Affected: 20.06 and later

 

Overview

SecureAuth Identity Platform 20.06 and later can automatically block an IP address that repeatedly fails to log in -- this is called Dynamic IP blocking. It can be turned on for a New Experience realm through a Policy, or for a Classic realm by editing that realm's web.config file directly.

There is more than one way to do this:

• For a New Experience realm -- see Method 1.
• For a Classic realm -- see Method 2.

In this article

• Method 1: Enable Dynamic IP Blocking in the New Experience
• Method 2: Enable Dynamic IP Blocking on a Classic Realm

Method 1: Enable Dynamic IP Blocking in the New Experience

Enabling Dynamic IP blocking in the New Experience is simpler, since it is added directly to a Policy.

1. In the New Experience, open IP Filtering and set the length of time and the number of failed login attempts to block on. These settings are global and apply to every realm that has Dynamic IP blocking enabled.
2. Add Dynamic IP blocking to the Policy used by the realm.

Method 2: Enable Dynamic IP Blocking on a Classic Realm

For a Classic realm, Dynamic IP blocking is enabled by editing the realm's web.config file directly.

1. Decrypt the realm's web.config file.
2. In the AppSettings section, add the following key:

<add key="IPBlockingServiceEnabled" value="True" />

3. Search the web.config file for State1 to find the Adaptive Authentication settings, and replace that state block with the following:

<analyzeEngine enabled="true" beginState="State1">
  <states>
    <state name="State1" type="SecureAuth.AnalyzeEngine.State.AdaptiveIpBlockState"
      category="PostAuthenticationState" requireUserId="false" enabled="true">
      <constraints>
        <constraint name="C1" key="adaptiveipblock" action="in">
          <transitions>
            <transition on="true" to="HardStop" />
            <transition on="false" to="next" />
            <transition on="unavailable" to="next" />
            <transition on="ipv6" to="HardStop" />
          </transitions>
        </constraint>
      </constraints>
    </state>

4. On the realm's Post Auth tab, in the WSTrust Blocking section, select Use Adaptive Authentication for initial IP Blocking.
5. Save the realm.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.