USers could not access Web Pages

jeggleston · ‎09-23-2013

Last Night my users were unable to surf the web, other services, such as email and FTP were available. I eventually noticed numerous "Shunned Packet" warnings when examining the ASA_5520 Syslog for the time period in question.

For example:

2013-09-22 20:28:47 Local7.Warning asa-1 Sep 22 2013 20:28:47: %ASA-4-401004: Shunned packet: x.x.20.27 ==> 75.75.75.75 on interface inside

2013-09-22 20:28:48 Local7.Warning asa-1 Sep 22 2013 20:28:48: %ASA-4-401004: Shunned packet: x.x.20.26 ==> 75.75.75.75 on interface inside

2013-09-22 20:28:48 Local7.Warning asa-1 Sep 22 2013 20:28:48: %ASA-4-401004: Shunned packet: x.x.20.27 ==> 75.75.75.75 on interface inside

2013-09-22 20:28:48 Local7.Warning asa-1 Sep 22 2013 20:28:48: %ASA-4-401004: Shunned packet: x.x.20.27 ==> 75.75.76.76 on interface inside

2013-09-22 20:28:48 Local7.Warning asa-1 Sep 22 2013 20:28:48: %ASA-4-401004: Shunned packet: x.x.20.27 ==> 75.75.75.75 on interface inside

2013-09-22 20:28:48 Local7.Warning asa-1 Sep 22 2013 20:28:48: %ASA-4-401004: Shunned packet: x.x.20.26 ==> 24.143.246.29 on interface inside

2013-09-22 20:28:48 Local7.Warning asa-1 Sep 22 2013 20:28:48: %ASA-4-401004: Shunned packet: x.x.20.26 ==> 205.152.144.23 on interface inside

2013-09-22 20:28:48 Local7.Warning asa-1 Sep 22 2013 20:28:48: %ASA-4-401004: Shunned packet: x.x.20.26 ==> 75.75.75.75 on interface inside

2013-09-22 20:28:48 Local7.Warning asa-1 Sep 22 2013 20:28:48: %ASA-4-401004: Shunned packet: x.x.20.27 ==> 75.75.75.75 on interface inside

The 20.26 and 20.27 IP's are my Private DNS Servers, so I am suspecting I was having some kind of DNS attack. I eventually rebooted both of these servers and my problems went away.

I guess my question is, what else can I look for that will help me determine if this was some kind of denial of service attack? And, if it was an attack, how do I prevent this in the future and what is the best way to recover?

- Jeff

Luis Silva Benavides · ‎09-25-2013

Hi,

The Thread-detection feature noticed that the your DNS servers sending an abnornal amount of traffic (or at least something that exceded the default parameters.)

The problem here was that when your internal PCs tried to resolve a website they query the internal DNS server but it was unable to access the internet because it was shunned.

Make sure your PC/Servers are not infected by any kind of Virus/Botnet. End-point protection is very important in this cases.

As you can see the ASA is doing its job . BTF (Botnet traffic filter) will be a good feature to have.

HTH

Luis Silva

"If you need PDI (Planning, Design, Implement) assistance feel free to reach us"

http://www.cisco.com/web/partners/tools/pdihd.html

Luis Silva