Hello all
I'm receiving hundreds of warning messages i am getting in our syslog from our Cisco ASA 5516-x. The warning message are on below same as screenshots and dunt know how to act with these kind of massages as its huge numbers of massages coming and dunt know how to stop or its kind of attack or what ?
Note: im using free syslog system called visual syslog server app and its an open source app and ASA version is Cisco ASA5516-X Threat Defense (75) Version 7.0.1 (Build 84) ,Also no routing configured on ASA and ASA is directly connected to L3 core switch
who are these IPs coming from ! i think attackers trying to access outside IF of ASA which directly connected to ISP router and how to stop this ? its huge number of massages coming and cannot stop !
How to block the incoming weak ports such as ping/telnet/ssh also traffic from internet to ASA OUTSIDE interface with ip 192.168.1.73 ?? i think something running trying to access ?
simple lab and wrong routing generate LOOP
as you can see same log you get.
so one Q
are you connect two port of FTD to same SW ? or is ISP have any connection to L3SW?
MHM
@Rob Ingram Thanks dear and i have 1st question , so these hundreds of massages coming to syslog i can ignore as all these connections denied already form outside to 192.168.1.73 (outside ASA i/f)? and this is the part of accessing from internet or outside to my ASA using outside I/F ! so shall i ignore ?
2nd question is for %FTD Duplicate TCP SYN from inside to outside with different initial !!
This messages appears during working hours when users connected to WIFI office VLAN using the inside ASA port (it-client-ap) and its disappearing when users leave office ! so i have just apply the below action using flexconnect but actually I'm not sure if this will do something or i have to remove ?
ASAFTD# show running-config all threat-detection
threat-detection rate dos-drop rate-interval 600 average-rate 100 burst-rate 400
threat-detection rate dos-drop rate-interval 3600 average-rate 80 burst-rate 320
threat-detection rate bad-packet-drop rate-interval 600 average-rate 100 burst-rate 400
threat-detection rate bad-packet-drop rate-interval 3600 average-rate 80 burst-rate 320
threat-detection rate acl-drop rate-interval 600 average-rate 400 burst-rate 800
threat-detection rate acl-drop rate-interval 3600 average-rate 320 burst-rate 640
threat-detection rate conn-limit-drop rate-interval 600 average-rate 100 burst-rate 400
threat-detection rate conn-limit-drop rate-interval 3600 average-rate 80 burst-rate 320
threat-detection rate icmp-drop rate-interval 600 average-rate 100 burst-rate 400
threat-detection rate icmp-drop rate-interval 3600 average-rate 80 burst-rate 320
threat-detection rate scanning-threat rate-interval 600 average-rate 5 burst-rate 10
threat-detection rate scanning-threat rate-interval 3600 average-rate 4 burst-rate 8
threat-detection rate syn-attack rate-interval 600 average-rate 100 burst-rate 200
threat-detection rate syn-attack rate-interval 3600 average-rate 80 burst-rate 160
threat-detection rate fw-drop rate-interval 600 average-rate 400 burst-rate 1600
threat-detection rate fw-drop rate-interval 3600 average-rate 320 burst-rate 1280
threat-detection rate inspect-drop rate-interval 600 average-rate 400 burst-rate 1600
threat-detection rate inspect-drop rate-interval 3600 average-rate 320 burst-rate 1280
threat-detection rate interface-drop rate-interval 600 average-rate 2000 burst-rate 8000
threat-detection rate interface-drop rate-interval 3600 average-rate 1600 burst-rate 6400
threat-detection basic-threat
threat-detection scanning-threat shun duration 1800
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
@tvotna Dear i have configured the below and not sure if it will impact or not & also i HYG the CPU details on below:
Basic-rate-Threat-Detection :-
threat-detection basic-threat
threat-detection rate acl-drop rate-interval 1200 average-rate 250 burst-rate 550
Threat-Detection-statistics :-
threat-detection statistics host number-of-rate 2
threat-detection statistics tcp-intercept
threat-detection statistics tcp-intercept rate-interval 45 burst-rate 400 average-rate 100
Threat-Detection-Scanning-shun: :-
threat-detection scanning-threat
threat-detection rate scanning-threat rate-interval 1200 average-rate 250 burst-rate 550
threat-detection scanning-threat shun
threat-detection scanning-threat shun duration 1000
Embryonic-connections-limitation:-
class-map tcp_syn
match port tcp eq 80
match port tcp eq 443
match port tcp eq 23
match port tcp eq 22
match port tcp eq 21
policy-map global_policy
class tcp_syn
set connection conn-max 100
set connection embryonic-conn-max 200
set connection per-client-embryonic-max 10
set connection per-client-max 5
set connection random-sequence-number enable
set connection timeout embryonic 0:0:45
set connection timeout half-closed 0:25:0
set connection timeout tcp 2:0:0
service-policy global_policy global
ProtectingAgainst-IP-Spoofing-Attacks:-
ip verify reverse-path interface outside
> show cpu usage
CPU utilization for 5 seconds = 3%; 1 minute: 2%; 5 minutes: 1%
> show cpu core
Core 5 sec 1 min 5 min
Core 0 1.0% 1.0% 0.7%
Core 1 0.8% 0.7% 0.6%
> show cpu profile
No profiling data.
> show cpu detailed
Break down of per-core data path versus control point cpu usage:
Core 5 sec 1 min 5 min
Core 0 0.4 (0.4 + 0.0) 0.9 (0.7 + 0.1) 0.6 (0.5 + 0.0)
Core 1 0.4 (0.4 + 0.0) 0.8 (0.6 + 0.1) 0.7 (0.5 + 0.0)
Current control point elapsed versus the data and control point elapsed for:
5 seconds = 18.3%; 1 minute: 18.1%; 5 minutes: 18.1%
CPU utilization of external processes for:
5 seconds = 0.4%; 1 minute: 0.9%; 5 minutes: 0.5%
Total System CPU utilization for:
5 seconds = 1.0%; 1 minute: 1.9%; 5 minutes: 1.4%> show cpu usage > show cpu core> show cpu profile > show cpu detailed
New massages came to syslog after apply the above configuration and its users at office complain of no internet connection !
