topic ASA: Threat-detection scanning-threat SHUN blocking our scan tools in Network Security

ASA: Threat-detection scanning-threat SHUN blocking our scan tools

KGrev — Mon, 04 Apr 2022 15:44:37 GMT

Hi,

I'm trying to assist a neighboring company.

They have Threat-detection scanning-threat SHUN enabled on their ASA devices.

With this enabled they are no longer able to use scanning tools like ACAS to check outside devices they monitor.

Currently I only have "Threat-detection scanning-threat" enabled on our ASA's so i cannot comment on the effects I am seeing.

This is a STIG requirement so I will have to implement it.

Does anyone know a way to get around this command blocking scanning tools?

Thank you

Re: ASA: Threat-detection scanning-threat SHUN blocking our scan tools

KGrev — Mon, 04 Apr 2022 19:20:31 GMT

Hi,

Found the answer to my question.

For anyone who is curious, cisco provides this in their setup guide:

In some cases, you may still want to prevent the ASA from shunning certain IPs. In order to do this, create an exception with the threat-detection scanning-threat shun except command.

ciscoasa(config)# threat-detection scanning-threat shun except ip-address 10.1.1.1 255.255.255.255
ciscoasa(config)# threat-detection scanning-threat shun except object-group no-shun