topic Blocking/Shunning Hosts with Service Policy Rules in Network Security

Blocking/Shunning Hosts with Service Policy Rules

victorr001 — Tue, 12 Mar 2019 00:40:05 GMT

I have an ASA 5510 deployed and we are getting a tonne of port scanning traffic (who isn't these days) and ping traffic.

The threat scanning thresholds seem a bit too high and was wondering if there is a way to use a Service Policy Rule to perform a Shun/Block of the hosts rather than the firewall simply blocking the request via the ACL and sending a reply.

In other words, if I do nothing, I know the ACL is protecting the resources but it is still replying to the client connection. I want the end result to be the same as a "Shun" where the connection is dropped and no reply is sent.

Does anyone have an example of how to employ Service Policy Rules to thwart Port Scanning and/or IP Spoofing?

Blocking/Shunning Hosts with Service Policy Rules

Peter Koltl — Sat, 22 Dec 2012 14:04:35 GMT

service resetoutside

command sets ASA to send TCP RST to denied traffic but it is disabled by default. That is, denied incoming packets are dropped silently by default.

Blocking/Shunning Hosts with Service Policy Rules

victorr001 — Sat, 22 Dec 2012 21:40:41 GMT

Thanks for the tip Peter.

I was really hoping to find a solution using the service policy if possible so that I could tune the parameters on packets per second, source ip, etc and be more specific about how to block these attacks.

The end result would be to reset the connection, but, the logic around whether it should be reset or not is what I am interested in.