Probe triggers SSH blacklist

RouterOS The Dude
1

I’ve just started trying to configure The Dude on my network.

I have my Mikrotik routers and CPEs set up with firewall filters equivalent to the “SSH blacklist” code from http://wiki.mikrotik.com/wiki/Bruteforce_login_prevention. The Dude triggers this blacklist when it polls the SSH service, because the router interprets the polls as failed attempts to brute-force a login. :frowning:

I could solve this by setting the SSH poll frequency to once every half hour, but I can’t find a way to do this without setting ALL service polls to once every half hour. Is there a way to set a special poll frequency for a specific service?

Failing that, I’d like to be able to say, “set the default polling never to poll SSH.” I can’t even find a way to do that, other than changing every individual device on the map.

Thanks for any advice!

2

Having seen no cleverer approaches posted in about a week, I ended up changing the SSH brute force filter on every device in my network to ignore probes from the NOC IP range. Nothing fixes a brute force filter better than brute force methods, I guess.