login block-for [secs] attempts [n] within [secs]
Configures the router to block login attempts from a source IP address after a specified number of failed attempts within a given time window, used to prevent brute-force attacks on VTY lines.
Definition: login block-for [secs] attempts [n] within [secs] is a Cisco IOS global config command. Configures the router to block login attempts from a source IP address after a specified number of failed attempts within a given time window, used to prevent brute-force attacks on VTY lines.
Overview
The `login block-for [secs] attempts [n] within [secs]` command is a critical security feature on Cisco IOS devices that protects against brute-force password attacks on VTY (Virtual Teletype) lines, which are used for remote management via Telnet or SSH. By configuring this command, the router will monitor failed login attempts from a specific source IP address. If the number of failed attempts exceeds the configured threshold within a specified time window, the router will block further login attempts from that IP address for a defined period. This command is part of the login enhancements introduced in Cisco IOS 12.3(8)T and later, providing a simple yet effective way to mitigate unauthorized access attempts without requiring external authentication servers or complex ACLs.
The underlying concept is rate limiting based on source IP. The router maintains a watch list of IP addresses that have failed login attempts. When the threshold is crossed, the source IP is placed in a quiet mode, during which all login attempts from that IP are silently dropped. This prevents attackers from repeatedly guessing passwords, significantly increasing the time required for a successful brute-force attack. The command operates at the global configuration level and affects all VTY lines (Telnet/SSH) by default, though it can be combined with `login quiet-mode access-class` to allow specific IPs to bypass the block.
Network engineers typically reach for this command when they need a lightweight, built-in solution to secure remote management access. Alternatives include using AAA with TACACS+ or RADIUS for centralized authentication and accounting, which can also enforce lockout policies but require additional infrastructure. Another alternative is to use ACLs to restrict VTY access to trusted IP ranges, but this does not prevent attacks from within the trusted range. The `login block-for` command is often used in conjunction with `login delay` and `login on-failure log` to provide comprehensive login security. It fits into the broader security configuration workflow after basic VTY line configuration (transport input, password) and before applying more advanced AAA policies.
Important IOS behaviors to note: The command is applied globally and affects all VTY lines. The quiet mode period is configurable, and the router logs blocked attempts if `login on-failure log` is enabled. The command does not require any privilege level beyond global config mode (privilege level 15). It has no impact on the running configuration beyond the added lines; however, the quiet mode state is not saved in the configuration—it is maintained in the router's dynamic memory. The `show login` command displays the current watch list and quiet mode status. Additionally, the command is not supported on all platforms; it requires a Cisco IOS image that includes the security feature set. On some older IOS versions, the command may not be available, and alternative methods like ACLs or SSH timeout must be used.
login block-for [secs] attempts [n] within [secs]When to Use This Command
- Protect SSH/Telnet access to a router from brute-force password guessing attacks
- Comply with security policies that require rate-limiting on management access
- Prevent repeated failed login attempts from a compromised host in the network
- Reduce CPU load from continuous authentication failures by temporarily blocking offending IPs
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| secs | <0-65535> | The duration in seconds that login attempts will be blocked from a source IP after exceeding the failed attempts threshold. Valid values range from 0 to 65535 seconds. A value of 0 disables the block feature. Common mistake: setting this too low (e.g., 30 seconds) may not effectively deter attackers; a typical value is 60-300 seconds. |
| n | <1-65535> | The number of failed login attempts allowed from a source IP within the 'within' time window before blocking occurs. Valid values are 1 to 65535. Setting this too high (e.g., 100) may allow too many attempts before blocking; a common value is 3-5. Note that failed attempts are counted per source IP, not per username. |
| secs | <1-65535> | The time window in seconds during which the failed attempts are counted. Valid values are 1 to 65535 seconds. This is the second 'secs' parameter in the command. Common mistake: confusing this with the block duration; ensure the window is reasonable (e.g., 60 seconds) to detect rapid attacks. |
Command Examples
Basic login block configuration
login block-for 120 attempts 5 within 60Router(config)# login block-for 120 attempts 5 within 60 Router(config)#
No output is generated upon successful configuration. The command sets a policy that after 5 failed login attempts within 60 seconds from the same source IP, that IP will be blocked for 120 seconds.
Verifying login block configuration
show loginLogin Blocking Configuration: Login block-for 120 attempts 5 within 60 Current login failures: 0 Current login block time: 0 Login failures per host: 0 Login block per host: 0 Login quiet-mode access-class: not configured Login quiet-mode: OFF Login attack: OFF Login delay: 1 second Login on-failure log: enabled Login on-success log: enabled Login successful: 0 Login failures: 0 Login failures per host: 0 Login block per host: 0 Login block time: 0
The output shows the configured parameters: block time (120 seconds), attempts (5), and within (60 seconds). Current counters are zero because no failures have occurred. 'Login quiet-mode' is OFF, meaning no IP is currently blocked. 'Login attack' is OFF, indicating no attack is detected. 'Login delay' is 1 second (default). Logging for failure and success is enabled.
Understanding the Output
The 'show login' command displays the current login blocking configuration and statistics. Key fields: 'Login block-for' shows the configured block time, attempts, and window. 'Current login failures' is the total count of failed logins since last reset.
'Current login block time' shows remaining block time if a block is active. 'Login failures per host' shows the number of failed attempts from each source IP. 'Login block per host' indicates if a specific IP is currently blocked.
'Login quiet-mode' shows ON if any IP is blocked. 'Login attack' shows ON if the number of failed attempts from any host exceeds the threshold. 'Login delay' is the time between successive login prompts (default 1 second).
'Login on-failure log' and 'Login on-success log' indicate whether logging is enabled. 'Login successful' and 'Login failures' are cumulative counters. In a real scenario, if an attack occurs, you would see 'Login attack: ON' and 'Login quiet-mode: ON' with non-zero block times.
Good values are zero failures and no blocks. Watch for high failure counts or active blocks indicating a brute-force attempt.
Configuration Scenarios
Basic brute-force protection for remote management
A network administrator wants to protect the router's VTY lines from brute-force password guessing attacks. The router is accessible from the internet, and there have been multiple failed login attempts from unknown IPs.
Topology
Internet --- (Gi0/0) R1 (Gi0/1) --- Internal NetworkSteps
- 1.Step 1: Enter global configuration mode: Router> enable Router# configure terminal
- 2.Step 2: Configure login block: Router(config)# login block-for 120 attempts 3 within 60
- 3.Step 3: (Optional) Enable logging of failed logins: Router(config)# login on-failure log
- 4.Step 4: (Optional) Configure a delay between login attempts: Router(config)# login delay 1
- 5.Step 5: Verify configuration: Router(config)# do show login
! Router(config)# login block-for 120 attempts 3 within 60 Router(config)# login on-failure log Router(config)# login delay 1 !
Verify: Use 'show login' to verify the configuration. Expected output shows 'Login Block-for' enabled with the configured parameters. Also check 'show login failures' to see recent failed attempts.
Watch out: The command does not block attempts from IPs that are already in the quiet mode until the block timer expires. Also, if the router reloads, the quiet mode state is lost; the configuration remains but the block resets.
Excluding trusted management hosts from login blocking
An organization has a dedicated management subnet (10.10.10.0/24) that should never be blocked, even if there are failed attempts. The login block should apply only to other IPs.
Topology
Management Host (10.10.10.100) --- (Gi0/0) R1 (Gi0/1) --- InternetSteps
- 1.Step 1: Enter global configuration mode: Router> enable Router# configure terminal
- 2.Step 2: Configure login block: Router(config)# login block-for 120 attempts 3 within 60
- 3.Step 3: Create an ACL to permit trusted hosts: Router(config)# access-list 10 permit 10.10.10.0 0.0.0.255
- 4.Step 4: Apply the ACL to quiet mode to exclude trusted hosts: Router(config)# login quiet-mode access-class 10
- 5.Step 5: Verify: Router(config)# do show login
! Router(config)# login block-for 120 attempts 3 within 60 Router(config)# access-list 10 permit 10.10.10.0 0.0.0.255 Router(config)# login quiet-mode access-class 10 !
Verify: Use 'show login' to confirm that 'Quiet-Mode access-class' is set to ACL 10. Test by attempting failed logins from a trusted IP (10.10.10.100) and an untrusted IP; the trusted IP should not be blocked.
Watch out: The ACL in 'login quiet-mode access-class' defines which IPs are EXEMPT from blocking, not which are blocked. Misconfiguring the ACL could accidentally block trusted hosts or allow all IPs to bypass the block.
Troubleshooting with This Command
When troubleshooting login issues related to the `login block-for` command, the primary tool is `show login`. This command displays the current login configuration, including the block duration, attempt threshold, and time window. It also shows the 'Watch List' of IP addresses that have failed login attempts and the 'Quiet Mode' status. Healthy output shows the configured parameters and an empty watch list if no failures have occurred. Problem indicators include a non-empty watch list with many entries, or the router being in quiet mode (blocking all logins) unexpectedly.
Key fields to focus on in `show login`: - 'Login Block-for' should show the configured values. If it says 'disabled', the command is not active. - 'Watch List' lists source IPs and their current attempt count. If an IP has reached the threshold, it will be in 'Quiet Mode'. - 'Quiet Mode' indicates whether the router is currently blocking logins from any IP. If 'Quiet Mode' is active, check the 'Quiet-Mode access-class' if configured.
Common symptoms this command helps diagnose: - Users unable to log in remotely: Check if their IP is in the watch list or quiet mode. Use `clear login quiet-mode` to remove the block for testing. - Intermittent access issues: The block timer may have expired, but the watch list still shows attempts. Use `show login failures` to see detailed failure logs. - High CPU due to login attempts: The command itself does not cause high CPU, but repeated failed attempts can be logged. Use `show logging` to see login failure messages.
Step-by-step diagnostic flow: 1. Verify the configuration: `show login` and `show running-config | include login`. 2. Check for blocked IPs: `show login` and look for 'Quiet Mode' entries. 3. If a specific IP is blocked and should not be, clear it: `clear login quiet-mode <ip-address>`. 4. If the block is too aggressive, adjust parameters: `login block-for` with new values. 5. Correlate with other commands: Use `show users` to see active sessions, `show ip ssh` for SSH details, and `debug login` (with caution) to see real-time login events.
Correlating with other show/debug commands: `show login failures` provides a history of failed attempts with timestamps. `debug login` can show each login attempt and whether it was blocked. `show logging` captures syslog messages for login failures if `login on-failure log` is enabled. These together help pinpoint whether the block is working as intended or if there are other issues like incorrect passwords or ACL misconfigurations.
CCNA Exam Tips
CCNA exam may ask: 'Which command blocks login attempts after 3 failures within 30 seconds for 60 seconds?' Answer: 'login block-for 60 attempts 3 within 30'
Remember that 'login block-for' is a global config command, not applied per line; it affects all VTY lines.
The exam might test that 'show login' displays whether quiet-mode is ON (blocking active) or OFF.
Know that the default login delay is 1 second; 'login delay' can be used to increase it.
Common Mistakes
Mistake: Applying 'login block-for' under VTY line configuration instead of global config. Consequence: Command is rejected or has no effect.
Mistake: Confusing the order of parameters (e.g., 'login block-for 5 attempts 120 within 60'). Consequence: The command is still accepted but the logic is wrong (block time becomes 5 seconds, attempts 120).
Mistake: Forgetting that the block applies per source IP, not globally. Consequence: Misinterpreting the behavior when multiple hosts fail.
login block-for [secs] attempts [n] within [secs] vs login delay [secs]
Both login block-for and login delay are Cisco IOS commands that enhance login security against brute-force attacks, but they operate differently: login block-for blocks the source IP after a threshold of failed attempts, while login delay simply introduces a wait between attempts. They are often confused because both are configured globally and affect VTY lines, yet their scope and behavior are distinct.
| Aspect | login block-for [secs] attempts [n] within [secs] | login delay [secs] |
|---|---|---|
| Scope | VTY lines only | All lines (console, aux, VTY) |
| Primary Action | Blocks source IP after threshold | Inserts delay before next attempt |
| Threshold Dependency | Activates only after N failures in M seconds | Always applied after each failed attempt |
| Recovery Mechanism | Automatic unblock after quiet period | No block; delay resets on successful login |
| Effect on Successful Login | Resets failure counter for that IP | Removes delay for next attempt |
Use login block-for [secs] attempts [n] within [secs] when you need to proactively block brute-force attacks from specific source IPs on VTY lines, especially over the internet.
Use login delay [secs] when you want to slow down repeated password guessing attempts on any line (including console) without blocking legitimate users.
Platform Notes
In Cisco IOS-XE, the `login block-for` command is fully supported with the same syntax and behavior as classic IOS. However, IOS-XE may have additional login features like `login on-success log` and `login on-failure log` that are enabled by default in some versions. The output of `show login` may include additional fields such as 'Login Delay' and 'Login Success Logging'.
In NX-OS (Cisco Nexus switches), the equivalent command is `login block-for` but with different syntax: `login block-for <seconds> attempts <count> within <seconds>`. NX-OS also supports `login quiet-mode access-class` similarly. However, NX-OS uses a different default behavior; for example, the block timer may be applied globally or per-VRF.
On Cisco ASA firewalls, there is no direct equivalent; instead, use `ssh timeout` and `ssh version` to limit sessions, or configure AAA with lockout policies. For IOS-XR, the command is not available; instead, use `ssh server session-limit` and `ssh server rate-limit` to control login attempts. Between IOS versions, the command has been stable since 12.3(8)T, but in 15.x and 16.x, the `login on-failure log` is often enabled by default.
Always verify with `show login` after configuration, as some platforms may require additional licensing (e.g., security technology package).
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions