We have a situation where the logs on our ASA is reaching our desired threshold which is 5000 every 5 minutes. One of the reasons behind this increased thresholds is because we have devices trying to get to internal IP's (ie 192.168.x.x) that don't exists in our network however because of our default routes, our switches are forwarding the traffic all the way to our ASA Firewall. At that point, our ASA firewall is dropping the packets and creating an alert because internal IP's cannot be processed through the firewall.
Our environment has two main campus's with a co-lo that takes us out to the internet. The two main campus's have a fiber gigabit connection between them and then each campus has a 100 mb connection to our Co-Lo. The device that interfaces with our Co-Lo from our campus's are two Cisco 6509 switches that run EIGRP. At our Co-Lo we have two 3560 switches along with two Cisco ASA 5520.
Because we are not using some of these internal IP's in our network, our default route statements are sending unused private IP's to our Cisco ASA firewalls. While we are currently investigating why our equipment is trying to get to these internal IP's, we would like to in the meantime try and prevent the traffic from getting to our ASA. Does anyone have any good ideas on how to accomplish this?
The only idea that I can think of is to place a ACL that blocks all unused private IP's at our two cores before they go to the Co-Lo but thats an ACL that I don't feel would be really neccessary. Has anyone run across this problem themselves and if so, what was your solution?
Start Free Trial
