topic Hi, in Network Security

ASA5505 - Block attacks against port

Kenzie6964 — Tue, 12 Mar 2019 03:58:24 GMT

We have a ASA 5505 that is being hammered on port 3389... Currently the port is set to allow connections from any which needs to stay the same, currently the port is being smashed by a bot that is trying to guess username/password.

Currently we have basic threat detection enabled and I have now enabled scanning threat detection and Shun hosts for 3600

Currently we arent being attacked so i cant tell if this helps the situation but what else can I apply to stop this... I estiamted that in a 30minute period over the past evening they spammed 1400 attempts.

Looking through the logs on the server, the source IP changes so blocking the IP is only a temporary fix.

Thanks for help in advance.

Anyone?

Kenzie6964 — Fri, 21 Mar 2014 14:54:01 GMT

Anyone?

Are they targeting an ip

Tormod Macleod — Fri, 21 Mar 2014 15:38:27 GMT

Are they targeting an ip address specifically or a URL? If they're using a URL you could try changing the public address. If you have a spare one

It's not a great solution but it will buy you some time to come up with something better

Also, you could deny entry to that port, tell your users to use a different port and use NAT to translate the new port to 3389

Another crap idea but it's all I've got

They are targetting a IP on

Kenzie6964 — Fri, 21 Mar 2014 16:05:21 GMT

They are targetting a IP on port 3389.

Changing the port isnt ideal but if thats what I have to do then I will have to.

Thanks

Hi,

johnlloyd_13 — Sat, 22 Mar 2014 03:01:46 GMT

Hi, You can report this incident to your ISP Abuse support team. Just give them your firewall logs and they can blackhole the attacking source IP at ISP level. They can also contact the remote admin/ISP to take corrective actions on their network.

Good Afternoon!

Ryan Cigelske — Mon, 24 Mar 2014 23:03:49 GMT

Good Afternoon! It is not a good idea to open up port 3389. It opens up to much risk to your environment. The best option you have, if you need remote access, is to utilize AnyConnect VPN. There are many options that come with the AnyConnect client and is rather easy to configure. Hope this helped out, sorry there really isn't a better answer! Cheers! Ryan