topic Prevent attacks on DNS Server on ASA/FWSM in Network Security

Prevent attacks on DNS Server on ASA/FWSM

S891 — Tue, 12 Mar 2019 02:43:36 GMT

Hi,

I am trying to block intrusion on DNS servers on Internet edge FWSM. Usually during an event there are a lot of (limit ia 1 Million) connection on DNS servers whic trigger FWSM mem and cpu to 100%. I have reducede UDP idle time to 1 minute.

What are other suggestions. I don't have IPS. The only defence is on FWSM. Can I create a policy that would limit number of connections from an outside source to say for example 500.

ANy other suggestions ?

Thanks

Prevent attacks on DNS Server on ASA/FWSM

mvsheik123 — Thu, 26 Sep 2013 21:17:04 GMT

Hi Fawad,

Check the below link. It may give some idea...

http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00809763ea.shtml

Thx

Prevent attacks on DNS Server on ASA/FWSM

pranesh deshpande — Fri, 27 Sep 2013 01:22:43 GMT

if you configured netflow check the the flow, enable dns inspection and dns gurd...

you can refer http://www.cisco.com/web/about/security/intelligence/dns-bcp.html

Thanks

Pranesh