?
Solved

How do I force my ASA 5510 to ignore ASA SYN scans from internal servers?

Posted on 2012-03-27
5
Medium Priority
?
1,683 Views
Last Modified: 2012-03-29
Hello All,

I manage a network that has Quintum devices that provide analogue to SIP conversion. The ASA 5510 is constantly flagging this device as sending SYN scans. The Quintum is on an internal trusted DMZ (through the ASA 5510). How do I force the ASA to ignore this particular device as it relates to SYN scanning. In other words I don't want the ASA to monitor or flag this device as related to SYN attacks.

Thanks in advance.
0
Comment
Question by:QuintumUser
  • 2
  • 2
5 Comments
 
LVL 10

Expert Comment

by:Rafael
ID: 37774132
Have you looked at putting it into a group and then trusting the group or block it altogether in the policies ?
0
 
LVL 4

Expert Comment

by:JZeolla
ID: 37776566
Tune your firewall by adjusting (raising) the threat-detection average-rate and burst-rates.  

threat-detection rate syn-attack rate-interval 600 average-rate 30 burst-rate 45    

This says that I will only shun syn-attacks which average 30 SYNs per second over 600 seconds, or shun them immediately if they hit 45 SYNs per second.  


Does this answer your question?
0
 

Author Comment

by:QuintumUser
ID: 37777175
Rcaballerojr, I am not sure how to put in a group to exclude the firewall from looking for Syn scans.

JZeolla, I will try to adjust the thresholds to see if that helps. When an IP is shunned will that affect my device negatively?

Thanks for the responses
0
 
LVL 4

Accepted Solution

by:
JZeolla earned 2000 total points
ID: 37778031
It could be, if the IP is legitimate traffic.  My assumption is that your Quintum device is getting inadvertently shunned.
0
 

Author Closing Comment

by:QuintumUser
ID: 37782746
Setting threshholds took care of it, thanks!!
0

Featured Post

Will You Be GDPR Compliant by 5/28/2018?

GDPR? That's a regulation for the European Union. But, if you collect data from customers or employees within the EU, then you need to know about GDPR and make sure your organization is compliant by May 2018. Check out our preparation checklist to make sure you're on track today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will show how Aten was able to supply easy management and control for Artear's video walls and wide range display configurations of their newsroom.
Will you be ready when the clock on GDPR compliance runs out? Is GDPR even something you need to worry about? Find out more about the upcoming regulation changes and download our comprehensive GDPR checklist today !
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
When cloud platforms entered the scene, users and companies jumped on board to take advantage of the many benefits, like the ability to work and connect with company information from various locations. What many didn't foresee was the increased risk…
Suggested Courses

601 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question