Solved

How do I force my ASA 5510 to ignore ASA SYN scans from internal servers?

Posted on 2012-03-27
5
1,490 Views
Last Modified: 2012-03-29
Hello All,

I manage a network that has Quintum devices that provide analogue to SIP conversion. The ASA 5510 is constantly flagging this device as sending SYN scans. The Quintum is on an internal trusted DMZ (through the ASA 5510). How do I force the ASA to ignore this particular device as it relates to SYN scanning. In other words I don't want the ASA to monitor or flag this device as related to SYN attacks.

Thanks in advance.
0
Comment
Question by:QuintumUser
  • 2
  • 2
5 Comments
 
LVL 10

Expert Comment

by:Rafael
ID: 37774132
Have you looked at putting it into a group and then trusting the group or block it altogether in the policies ?
0
 
LVL 4

Expert Comment

by:JZeolla
ID: 37776566
Tune your firewall by adjusting (raising) the threat-detection average-rate and burst-rates.  

threat-detection rate syn-attack rate-interval 600 average-rate 30 burst-rate 45    

This says that I will only shun syn-attacks which average 30 SYNs per second over 600 seconds, or shun them immediately if they hit 45 SYNs per second.  


Does this answer your question?
0
 

Author Comment

by:QuintumUser
ID: 37777175
Rcaballerojr, I am not sure how to put in a group to exclude the firewall from looking for Syn scans.

JZeolla, I will try to adjust the thresholds to see if that helps. When an IP is shunned will that affect my device negatively?

Thanks for the responses
0
 
LVL 4

Accepted Solution

by:
JZeolla earned 500 total points
ID: 37778031
It could be, if the IP is legitimate traffic.  My assumption is that your Quintum device is getting inadvertently shunned.
0
 

Author Closing Comment

by:QuintumUser
ID: 37782746
Setting threshholds took care of it, thanks!!
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Cisco Supervisor upgrade to 2T 3 66
Read-only SNMP string example ? 7 90
PCI Compliance with TLS 1.0 - all systems required 21 114
WiFi Router device supports GPON! 3 58
BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
The use of stolen credentials is a hot commodity this year allowing threat actors to move laterally within the network in order to avoid breach detection.
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…
Finds all prime numbers in a range requested and places them in a public primes() array. I've demostrated a template size of 30 (2 * 3 * 5) but larger templates can be built such 210  (2 * 3 * 5 * 7) or 2310  (2 * 3 * 5 * 7 * 11). The larger templa…

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question