topic High CPU due to dispatch unit process in cisco ASA 5520 in Network Security

High CPU due to dispatch unit process in cisco ASA 5520

anoop verma — Fri, 21 Feb 2020 15:31:48 GMT

dispatch unit process using almost 100% CPU; frequency of the incident is 2 hours; FW get hanged and after removing the cable from FW, it get stable; again same after 2 hours;

hardware:- asa 5520

topology:-

SW 2960----------FW5520_______asr1002

tcp connection sudennely increases to 5K, under normal condition it was less than 100;

Kindly share resolution steps;

Re: High CPU due to dispatch unit process in cisco ASA 5520

Mohammed al Baqari — Mon, 19 Mar 2018 09:16:33 GMT

Check if you are under attack.

get the output of show perfmon

Re: High CPU due to dispatch unit process in cisco ASA 5520

anoop verma — Mon, 19 Mar 2018 10:23:08 GMT

yes, as per my observation its a dos attack; few host(like 10.x.y.20) establishing tcp connection with 10.x.y.255 over port number 445; after scan that host 20 virus found; i want to isolate this;

Re: High CPU due to dispatch unit process in cisco ASA 5520

Mohammed al Baqari — Mon, 19 Mar 2018 11:28:33 GMT

Ok. Attack on 445 isn't good. You should imlpment wannaCry ACLs
immediately.

Re: High CPU due to dispatch unit process in cisco ASA 5520

anoop verma — Mon, 19 Mar 2018 11:46:54 GMT

pls share configuration;