vianceadmin
asked on
Macbook Pro being added to "shun" list in ASA Threat Detection
This has happened a few times so I setup a syslog server to capture the debug output for this Macbook's wireless connection.
After losing connectivity to the Internet, I looked at the logs and I'm seeing this:
2014-01-23 14:41:44 Local4.Warning 10.3.101.1 Jan 23 2014 14:41:44: %ASA-4-401002: Shun added: 10.3.101.191 0.0.0.0 0 0
And then a little further down:
2014-01-23 14:41:44 Local4.Warning 10.3.101.1 Jan 23 2014 14:41:44: %ASA-4-733102: Threat-detection adds host 10.3.101.191 to shun list
I've never had this issue before until now...I have another Mac on the network as well but haven't had any issues with it being added to the shun list. Any help on this is appreciated. Should I modify my threat detection parameters? Any chance there may be some malicious software on the Mac OSX?
After losing connectivity to the Internet, I looked at the logs and I'm seeing this:
2014-01-23 14:41:44 Local4.Warning 10.3.101.1 Jan 23 2014 14:41:44: %ASA-4-401002: Shun added: 10.3.101.191 0.0.0.0 0 0
And then a little further down:
2014-01-23 14:41:44 Local4.Warning 10.3.101.1 Jan 23 2014 14:41:44: %ASA-4-733102: Threat-detection adds host 10.3.101.191 to shun list
I've never had this issue before until now...I have another Mac on the network as well but haven't had any issues with it being added to the shun list. Any help on this is appreciated. Should I modify my threat detection parameters? Any chance there may be some malicious software on the Mac OSX?
ASKER
Right now, it shows:
XXXXXXX# show threat-detection statistics host 10.3.101.191
Current monitored hosts:1194 Total not monitored hosts:18826
Average(eps) Current(eps) Trigger Total events
XXXXXXX# show threat-detection statistics host 10.3.101.191
Current monitored hosts:1194 Total not monitored hosts:18826
Average(eps) Current(eps) Trigger Total events
what does
show shun
give
is it not being shunned anymore?
show shun
give
is it not being shunned anymore?
ASKER
Doesn't appear to be. When I run the show shun command, it just takes me back to the #
Just curious why the ASA would think that the Mac is some type of threat? Here are my threat detection commands:
threat-detection basic-threat
threat-detection scanning-threat shun except ip-address x.x.x.x 255.255.255.255 (network monitoring device)
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
Just curious why the ASA would think that the Mac is some type of threat? Here are my threat detection commands:
threat-detection basic-threat
threat-detection scanning-threat shun except ip-address x.x.x.x 255.255.255.255 (network monitoring device)
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
show threat-detection statistics host 10.3.101.191
if the IP of the host getting shunned changes, use that IP instead when running the command