How do I force my ASA 5510 to ignore ASA SYN scans from internal servers?

Hello All,

I manage a network that has Quintum devices that provide analogue to SIP conversion. The ASA 5510 is constantly flagging this device as sending SYN scans. The Quintum is on an internal trusted DMZ (through the ASA 5510). How do I force the ASA to ignore this particular device as it relates to SYN scanning. In other words I don't want the ASA to monitor or flag this device as related to SYN attacks.

Thanks in advance.
QuintumUserAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

RafaelCommented:
Have you looked at putting it into a group and then trusting the group or block it altogether in the policies ?
0
JZeollaCommented:
Tune your firewall by adjusting (raising) the threat-detection average-rate and burst-rates.  

threat-detection rate syn-attack rate-interval 600 average-rate 30 burst-rate 45    

This says that I will only shun syn-attacks which average 30 SYNs per second over 600 seconds, or shun them immediately if they hit 45 SYNs per second.  


Does this answer your question?
0
QuintumUserAuthor Commented:
Rcaballerojr, I am not sure how to put in a group to exclude the firewall from looking for Syn scans.

JZeolla, I will try to adjust the thresholds to see if that helps. When an IP is shunned will that affect my device negatively?

Thanks for the responses
0
JZeollaCommented:
It could be, if the IP is legitimate traffic.  My assumption is that your Quintum device is getting inadvertently shunned.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
QuintumUserAuthor Commented:
Setting threshholds took care of it, thanks!!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Network Security

From novice to tech pro — start learning today.