topic Re: ASA 5520 False SYN attacks? in Network Security

ASA 5520 False SYN attacks?

ericn8484_2 — Mon, 11 Mar 2019 16:35:33 GMT

I noticed that our ASA firewall is showing false SYN attacks. When I look at them, I see such things as our AS400 sending print jobs to a remote facility with an IPSEC tunnel, another example is our PC's connecting to an outsourced content filtering solution.

Is there any way to tell the Cisco ASA firewall that these are not SYN attacks and that its acceptable traffic?

Re: ASA 5520 False SYN attacks?

Panos Kampanakis — Wed, 04 Nov 2009 15:17:18 GMT

Is threat detection showing those as SYN attacks?

If yes I don't think there is something you can do to exclude these hosts from being flagged.

But you can change the attack threat detection thresholds on your ASA so that it doesn't bark about attacks.

I hope it helps.