ASA Risk:Spoofed EIGRP Packet Saturation DoS

[Yuliang Liang]

We have detected a high risk in asa5510.

risk information:

Port:

22 TCP - ssh

Script Id:

Name:

Cisco IOS: Spoofed EIGRP Packet Saturation DoS

Risk Score:

7.8(High risk)

Product:

Cisco IOS

Extended Interior Gateway Routing Protocol (EIGRP), as implemented in Cisco IOS 11.3 through 12.2 and other products, allows remote attackers to cause a denial of service (flood) by sending a large number of spoofed EIGRP neighbor announcements, which results in an ARP storm on the local network.

Device details:

verson:8.6

no EIGRP session

Does Cisco have any solutions to close this risk? 

[Murali]

Hi ,

Is ASA  detected this for your network or for the ASA itself? if it's a router/L3 switch you can mitigate this threat by limiting interfaces(hard coding network command to the interface ip address)  that participate in eigrp routing ( you don't want to listen eigrp packets on the interfaces that you don't want to have eigrp neighbor-ship)

HTH

Murali.