topic Re: ASA5506 Getting Hammered By Port 443 Connection Attempts in Network Security

ASA5506 Getting Hammered By Port 443 Connection Attempts

rschember1 — Fri, 25 Oct 2024 17:41:27 GMT

Is this anything to be concerned about? I have an ASA5506 that is just getting hammered with Russian IPs trying to connect to port 443. I have the ASA fairly hardened -- there is no access to 443 and AnyConnect requires a certificate to connect, but it's still worrying to see these attacks.

Is there anything else I should be doing here? Should I have some sort of inline IPS/IDS in front of the ASA to block by geolocation?

Re: ASA5506 Getting Hammered By Port 443 Connection Attempts

Rob Ingram — Fri, 25 Oct 2024 18:00:09 GMT

@rschember1 you can configure threat detection, which will automatically shuns the host (IP address) that exceeds the configured thresholds, to prevent further attempts - this will limit the attacks. You'd need to upgrade to 9.16.4.67 or .71

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-asa/222315-configure-threat-detection-services-for.html

https://software.cisco.com/download/home/286286701/type/280775065/release/9.16.4%20Interim

Or yes, placing another NGFW in front of the ASA with Geolocation filtering might be a good solution.

Re: ASA5506 Getting Hammered By Port 443 Connection Attempts

rschember1 — Fri, 25 Oct 2024 19:51:55 GMT

@Rob Ingram Excellent! I'll upgrade the OS over the weekend.

Do you know if this "Threat Detection for Remote Access VPN Services" feature uses the same shun settings as the scanning threat detection (below), i.e. do I need to have these configured for the threat detection services for VPN to work?

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113685-asa-threat-detection.html#:~:text=In%20order%20to%20allow%20the,%2Ddetection%20scanning%2Dthreat%20command.&text=This%20allows%20Scanning%20Threat%20Detection,scanning%2Dthreat%20shun%20duration%20command.

The document you posted states "When you enable these services, the Secure Firewall automatically shuns the host (IP address) that exceeds the configured thresholds", so I'm leaning toward this NOT using the same settings as the scanning threat detection and just working independently -- do you agree?

Re: ASA5506 Getting Hammered By Port 443 Connection Attempts

Rob Ingram — Fri, 25 Oct 2024 19:56:21 GMT

@rschember1 yes I agree.

The link I previously posted is threat detection specific for VPN attacks, use those settings to restrict VPN attacks.

Re: ASA5506 Getting Hammered By Port 443 Connection Attempts

rschember1 — Fri, 25 Oct 2024 20:03:47 GMT

I'll follow up on Monday with the results. Thank you for the info.

Re: ASA5506 Getting Hammered By Port 443 Connection Attempts

rschember1 — Mon, 28 Oct 2024 11:25:56 GMT

@Rob Ingram - No luck unfortunately. I'm thinking it's not triggering the VPN attack detection because the connection attempt isn't making it past the ACL, so it's not actually initiating a VPN connection. It's good to know this protection is available though, and I will definitely enable it across the board on all of my ASA devices.

Re: ASA5506 Getting Hammered By Port 443 Connection Attempts

Rob Ingram — Mon, 28 Oct 2024 11:44:18 GMT

@rschember1 is it being dropped by the interface ACL, inbound on the outside interface? That ACL would only effect traffic "through" the ASA, not "to" the ASA (SSL-VPN).

Re: ASA5506 Getting Hammered By Port 443 Connection Attempts

ahollifield — Mon, 28 Oct 2024 11:58:22 GMT

https://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/eos-eol-notice-c51-744797.html

Re: ASA5506 Getting Hammered By Port 443 Connection Attempts

rschember1 — Mon, 28 Oct 2024 12:01:05 GMT

@Rob Ingram Yes, it appears to be getting dropped by the outside interface ACL. Maybe it's because I don't have SSL-VPN enabled? I only allow AnyConnect with IKEv2, so SSL-VPN is disabled on the outside interface. So maybe this isn't being considered a VPN connection attempt since the SSL service is disabled on that interface?

Re: ASA5506 Getting Hammered By Port 443 Connection Attempts

Rob Ingram — Mon, 28 Oct 2024 12:04:55 GMT

@rschember1 ok that might make sense then if SSL is not used.