About a week ago, our ASA 5545 started to scan random ports on our management server. The AV detects the port scan, and throws up a temporary block on traffic, which means the device randomly goes down for 10-15 minutes throughout the day and night. Here is the logging info from AV, but I'm pretty certain the ASA doesn't have the ability to scan. There is no NAT statement to the inside IP.
Somebody is scanning your computer.
Your computer's UDP ports:
50967, 53616, 53228, 61745 and 53162 have been scanned from <firewall_ip>.
Somebody is scanning your computer.
Your computer's UDP ports:
54676, 60187, 56973, 57651 and 62472 have been scanned from <firewall_ip>.
Somebody is scanning your computer.
Your computer's UDP ports:
64649, 62761, 59096, 64934 and 63694 have been scanned from <firewall_ip>.
Any thoughts as to what might be causing this? Thanks
