Solved

ASA Shunning internal IP

Posted on 2016-10-12
10
37 Views
Last Modified: 2016-10-12
Every once and awhile our email filter gets shunned by our ASA. Doing a no shun 192.168.0.208 fixes it, but I'm not sure why it is being shunned at all since the Threat detection is set to exclude the 192.168.0.0/23 subnet (see image).capture
0
Comment
Question by:bhieb
  • 5
  • 5
10 Comments
 
LVL 28

Expert Comment

by:Jan Springer
ID: 41841015
Sometimes mail servers generate a lot of traffic.  Either adjust the threat detection or exclude that IP.

And check that it hasn't been compromised.
0
 

Author Comment

by:bhieb
ID: 41841034
The ip should be excluded per the screenshot, the whole subnet is.
0
 
LVL 28

Expert Comment

by:Jan Springer
ID: 41841038
I see the screenshot but it apparently isn't.

Is the exclusion visible in CLI?
0
 

Author Comment

by:bhieb
ID: 41841046
What is the cli command I can check.
0
 
LVL 28

Expert Comment

by:Jan Springer
ID: 41841048
sh run | i shun

You should see:

threat-detection scanning-threat shun except ip-address 192.168.0.0 255.255.254.0
0
Zoho SalesIQ

Hassle-free live chat software re-imagined for business growth. 2 users, always free.

 

Author Comment

by:bhieb
ID: 41841049
show shun returns nothing
0
 

Author Comment

by:bhieb
ID: 41841050
threat-detection scanning-threat shun except ip-address 192.168.0.0 255.255.254.0

It appears to be excluded.
0
 
LVL 28

Accepted Solution

by:
Jan Springer earned 500 total points
ID: 41841057
We must have posted at the same time.

I have never seen an excluded IP get put on a shut list.  Having said that, I don't exclude subnets.

I would recommend adding the mail server IP with a /32 mask to see if that corrects the issue.
0
 

Author Comment

by:bhieb
ID: 41841060
I agree it is really weird, and it has been well over a year since I last touched the firewall and this config has not changed. I think I have smartnet on it, so I can just log a ticket and make them fix it. I'm sure I'm due for an os upgrade as well.

Was just hoping it was something easy.
0
 
LVL 28

Expert Comment

by:Jan Springer
ID: 41841069
It might be that it's a bug when working with a subnet.

Also, there have been several security vulnerabilities -- make sure that you get a release that covers them all and stays within the same train so that you don't have to buy more memory (if you're running something older).
0

Featured Post

Zoho SalesIQ

Hassle-free live chat software re-imagined for business growth. 2 users, always free.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Cisco Router DMZ 5 63
BGP Code 12 42
Help with an ACL to isolate our wireless newtork 9 19
Load Balancing 3 16
We sought a budget ($5,000) firewall solution that would provide all the performance we needed with no single point of failure.  Hosting a SAAS web application in our datacenter, it was critical that we find a way to keep connectivity up and inbound…
Imagine you have a shopping list of items you need to get at the grocery store. You have two options: A. Take one trip to the grocery store and get everything you need for the week, or B. Take multiple trips, buying an item at a time, to achieve t…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

28 Experts available now in Live!

Get 1:1 Help Now