topic Re: CSA throws portscan alert in Network Security https://community.cisco.com/t5/network-security/csa-throws-portscan-alert/m-p/454932#M90891 <HTML><HEAD></HEAD><BODY><P>Hi, Sorry. It's version 4.5.</P></BODY></HTML> Thu, 22 Dec 2005 19:46:31 GMT piltze 2005-12-22T19:46:31Z CSA throws portscan alert https://community.cisco.com/t5/network-security/csa-throws-portscan-alert/m-p/454930#M90889 <P>Good morning,</P><P></P><P>I'm getting an Alert in CSA, generated by Rule 18, stating that "A portscan was detected Reason: ICMP unreachable. ICMP: 10.64.100.101 -&gt; 10.65.110.118 type destination_unreachable/03. </P><P></P><P>The target address (.118) is a voice gateway on a 6509. I dont see any reason for this to occur. Thoughts?</P><P></P> Sun, 10 Mar 2019 09:48:24 GMT https://community.cisco.com/t5/network-security/csa-throws-portscan-alert/m-p/454930#M90889 piltze 2019-03-10T09:48:24Z Re: CSA throws portscan alert https://community.cisco.com/t5/network-security/csa-throws-portscan-alert/m-p/454931#M90890 <HTML><HEAD></HEAD><BODY><P>You didn't mention what version of CSA you are running and there are different options for each.</P><P></P><P>You may want to turn off the ICMP deny logging or add your voice gateway to the authorized port scanners. Portscan logging is a different matter and it depends on which version you have. </P></BODY></HTML> Mon, 19 Dec 2005 19:41:32 GMT https://community.cisco.com/t5/network-security/csa-throws-portscan-alert/m-p/454931#M90890 tsteger1 2005-12-19T19:41:32Z Re: CSA throws portscan alert https://community.cisco.com/t5/network-security/csa-throws-portscan-alert/m-p/454932#M90891 <HTML><HEAD></HEAD><BODY><P>Hi, Sorry. It's version 4.5.</P></BODY></HTML> Thu, 22 Dec 2005 19:46:31 GMT https://community.cisco.com/t5/network-security/csa-throws-portscan-alert/m-p/454932#M90891 piltze 2005-12-22T19:46:31Z Re: CSA throws portscan alert https://community.cisco.com/t5/network-security/csa-throws-portscan-alert/m-p/454933#M90892 <HTML><HEAD></HEAD><BODY><P>OK, then make sure you are using the Internal IP Stack hardening module and add your voice gateway to the Authorized Port Scanners network address set. You also may want to exclude the gateway from the host addresses that are scanned by those rules.</P><P></P><P>That may do the trick.</P><P></P><P>Tom</P></BODY></HTML> Thu, 22 Dec 2005 21:05:22 GMT https://community.cisco.com/t5/network-security/csa-throws-portscan-alert/m-p/454933#M90892 tsteger1 2005-12-22T21:05:22Z