topic Filter SSH access to Cisco ASA from Internet in Network Security

Filter SSH access to Cisco ASA from Internet

anton_nikulin — Fri, 21 Feb 2020 13:32:19 GMT

Hello,

I have ASA 5520 with interface 'inside' in local network and interface 'outside' facing the internet.

there are line ssh 192.168.0.0 255.255.0.0 inside for access to ASA from local network. And deny any any rule for incoming traffic on 'outside' interface.

I see a lot of denying connection from different addresses to 'outside' interface on ASA in syslog. When I scan outside interface with nmap from internet tcp/22 port is marked as closed. Are there any possibilities to make it filtered?

The syslog entries are just

Marvin Rhoads — Tue, 21 Jul 2015 16:19:45 GMT

The syslog entries are just an indicator of the ASA doing its job of blocking the script kiddies from getting in to your firewall. I see them all the time on Internet-facing firewalls when the logging level is set high enough and there's an explicit deny on the inbound access-list (vs. the implicit deny any any that will be on the outside).

You can either lower the logging level (4 is recommended), filter that message, or change it to a level that's less important than your day-to-day level so it goes away as a recurring message that requires no action.

Thank you very much

anton_nikulin — Wed, 22 Jul 2015 03:16:34 GMT

Thank you very much