ASA5506 Getting Hammered By Port 443 Connection Attempts

[rschember1]

Is this anything to be concerned about? I have an ASA5506 that is just getting hammered with Russian IPs trying to connect to port 443. I have the ASA fairly hardened -- there is no access to 443 and AnyConnect requires a certificate to connect, but it's still worrying to see these attacks.

Is there anything else I should be doing here? Should I have some sort of inline IPS/IDS in front of the ASA to block by geolocation?

[Rob Ingram · Accepted solution]

@rschember1 you can configure threat detection, which will automatically shuns the host (IP address) that exceeds the configured thresholds, to prevent further attempts - this will limit the attacks. You'd need to upgrade to 9.16.4.67 or .71

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-asa/222315-configure-threat-detection-services-for.html

https://software.cisco.com/download/home/286286701/type/280775065/release/9.16.4%20Interim

Or yes, placing another NGFW in front of the ASA with Geolocation filtering might be a good solution.

[rschember1]

@Rob Ingram Excellent! I'll upgrade the OS over the weekend.

Do you know if this "Threat Detection for Remote Access VPN Services" feature uses the same shun settings as the scanning threat detection (below), i.e. do I need to have these configured for the threat detection services for VPN to work?

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113685-asa-threat-detection.html#:~:text=In%20order%20to%20allow%20the,%2Ddetection%20scanning%2Dthreat%20command.&text=This%20allows%20Scanning%20Threat%....

The document you posted states "When you enable these services, the Secure Firewall automatically shuns the host (IP address) that exceeds the configured thresholds", so I'm leaning toward this NOT using the same settings as the scanning threat detection and just working independently -- do you agree?

[Rob Ingram]

@rschember1 yes I agree.

The link I previously posted is threat detection specific for VPN attacks, use those settings to restrict VPN attacks.

[rschember1]

I'll follow up on Monday with the results. Thank you for the info.

[rschember1]

@Rob Ingram - No luck unfortunately. I'm thinking it's not triggering the VPN attack detection because the connection attempt isn't making it past the ACL, so it's not actually initiating a VPN connection. It's good to know this protection is available though, and I will definitely enable it across the board on all of my ASA devices.

[Rob Ingram]

@rschember1 is it being dropped by the interface ACL, inbound on the outside interface? That ACL would only effect traffic "through" the ASA, not "to" the ASA (SSL-VPN).

[rschember1]

@Rob Ingram Yes, it appears to be getting dropped by the outside interface ACL. Maybe it's because I don't have SSL-VPN enabled? I only allow AnyConnect with IKEv2, so SSL-VPN is disabled on the outside interface. So maybe this isn't being considered a VPN connection attempt since the SSL service is disabled on that interface?

[Rob Ingram]

@rschember1 ok that might make sense then if SSL is not used.

[ahollifield]

https://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/eos-eol-notice-c51-744797.html