I have a lot of outside hosts trying to scan my network and would like to shun them for a certain period.
A lot of this hosts are probing (scanning a range of addresses looking for host that listens to port 23 or some other port).
I tried setting up the asa to shun those atackers but the only thing I got working was getting a host (test attacker) shun when attacking a single host inside my network using NMAP.
I see a lot of events like this
733100 [ Scanning] drop rate-1 exceeded. Current burst rate is 5 per second, max configured rate is 5; Current average rate is 2 per second, max configured rate is 5; Cumulative total count is 1712
but there are no hosts that are shun.
Here is the relevant configuration:
no threat-detection rate acl-drop rate-interval 600 average-rate 400 burst-rate 800
threat-detection rate acl-drop rate-interval 600 average-rate 400 burst-rate 5
threat-detection rate acl-drop rate-interval 3600 average-rate 320 burst-rate 640
no threat-detection rate scanning-threat rate-interval 600 average-rate 5 burst-rate 10
threat-detection rate scanning-threat rate-interval 600 average-rate 5 burst-rate 5
threat-detection rate scanning-threat rate-interval 3600 average-rate 4 burst-rate 8
no threat-detection rate syn-attack rate-interval 600 average-rate 100 burst-rate 200
threat-detection rate syn-attack rate-interval 600 average-rate 30 burst-rate 15
threat-detection rate syn-attack rate-interval 3600 average-rate 80 burst-rate 160
threat-detection basic-threat
threat-detection scanning-threat shun except ip-address X.Y.128.128 255.255.255.224
threat-detection scanning-threat shun duration 600
no threat-detection statistics access-list
no threat-detection statistics tcp-intercept
Is there something else I need to do to enable shunning of attackers?
