If brute force protection is not being enforced on your Sangfor NGAF (Next-Generation Application Firewall) despite configuring it in the WAF (Web Application Firewall) policy template for web-based login passwords, it's essential to ensure that the settings are properly configured and activated within the NGAF's interface. Double-check that the WAF policy template is correctly applied to the relevant web-based login services and that the brute force protection parameters, such as threshold limits and blocking actions, are appropriately configured to trigger enforcement actions upon detection of suspicious login attempts.

To enforce Brute Force protection on your Sangfor NGAF, follow these steps:

1. Log in to the Sangfor NGAF web interface.
2. Navigate to the "Security" module and then click on "Web Application Firewall (WAF)".
3. In the WAF management page, select the "Policy Template" option from the left sidebar.
4. Find the policy template you wish to modify or create a new one if needed.
5. Click on the "Edit" button associated with the selected policy template.
6. Under the "Security Policy" section, locate the "Web-based Login Password" option.
7. Enable the "Brute Force Protection" feature by clicking the checkbox or moving the toggle to the "On" position.
8. Configure additional settings, such as the number of failed login attempts before the protection kicks in, the lockout duration, and the allowed login speed, as per your requirements.
9. Click "OK" to save the changes.
10. Apply the updated policy template to the relevant interfaces or zones within your NGAF configuration.