"async" user Bombing ISE. why ? and how can I block it ?

[robad]

Hi,

We having ISE 2.4.0.357

In the "Live Logs" I see 500,000 + logs about a user called "async" that always trying to access to my Terminal Servers.

I see that it comes from various devices from "Async" ports

How can I prevent it, and why does it happen ??

[I created a rule that prevent access from this user, but it still blows my logs, and the CPU is very high]

Please assist guys, it's very important to us

Any info will help

Edit :

*****

Now, when trying to deep dive into it, and checking the detailed report, I'm seeing strange things.

I see that seems that the devices are blowing garbage. looks like there is something getting crazy on the device itself, and it's blowing away commands and lines.

But I can't understand why it harming ISE...

[Surendra]

This can happen to a device to which a. bad cable is connected and creating noice on the Line. Would suggest you to. Check the device from which this TACACS/RADIUS request is coming in from and change the cables may be?

[robad]

Hi, and thanks for your reply

Maybe I didn't mentioned :

It happened from multiple devices, and from multiple lines from each device..

So don't think it's a cable issue :( 

[Surendra]

Is it from a virtual line or from Console/Aux ?

[Damien Miller]

Looks like the NADs are misconfigured, and it also looks like they are console servers. I'm basing this on the the fact that I see "connect ASA #1" under the command line you circled.

So it looks like the NAD is configured for TACACS, and each command authorization results in a failed attempt against ISE. Fix the NADs, and you will clean up the logs.

[robad]

thanks guys for the replies :

@Surendra  -

It comes from VTY lines

I mean, devices that connected to the TS lines for console access .

hope it's clear enough 

@Damien Miller -

What is NAD ? and how do I fix it ?

[sorry for the ignorance]

[hslai]

NAD refers to a network device; in your case, the terminal servers.

On your terminal servers, you should be able to configure it to bypass AAA; e.g.

aaa authentication login TTY none
!
line 0/0/0 0/2/15
 login authentication TTY
 exit
!

[robad]

OK,

But, it won't harm my clients to be able to connect to their devices via console from those Terminal Servers ?

[SzantaiNorbert]

We had the same problem in our network, and turned out that "aaa authorization console" was enabled in the switches. Turn it off and the logs will disappear.