10-19-2011 08:39 AM - edited 03-11-2019 02:39 PM
Hello guys,, first time posting on this forum.
Im running ASA 8.0(3) on Active/StandBy failover pair.
Last night I realized the CPU usage of my production ASA was 99%,,, on the ASDM Firewall Dashboard I can see counters like this:
Dropped Packet Rate (ACL Dropped) = 6000+ (more than 6 thousand)
Scanning Attacks = 18600+ (more than Eighteen thousand)
Im having about 130 connections and 250 NAT Xlates
Pretty small environment.
I went on the ASDM and checked the RealTime Log viewer and I have about 30 entries per second of these:
4 | Oct 19 2011 | 11:35:12 | 401004 | Shunned packet: 10.64.10.1 ==> 10.64.0.1 on interface NewLAN |
There is nothing on the Coumns "Source IP" " Source Port" "Destination IP" or "Destination Port"
Only these columns are populated:
Severity
Date
Time
SyslogID
Description
The IP 10.64.0.1 is my ASA
The IP 10.64.10.1 is a PC with a Monitoring Tool (Solarwinds Orion with IPAM)
Yesterday night I disabled the Interface on the PC and waited for 15 minutes,, and I still saw the counters, nothing changed.
I enabled the Interface on the PC again,, and installed Wireshark,, I dont see that PC trying to connect to 10.64.0.1.
I wonder what else I could check and how to track down what is killing the CPU on my firewall.
I hope somebody can give me some ideas.
Thanks!!
10-19-2011 01:16 PM
Well
I just realized tha the IP 10.64.10.1 (my monitoring machine) was in the "shunned" list.
That machine has an IPAM module that was supposed to scan all subnets every 8 hours.
Maybe the ASA didnt like that.
The funny thing is,,, how come that machine was able to monitor the subnet (i didnt see any message on the IPAM saying"cannot reach network"etc.
Also,, why the monitoring machine was interpreted as an attach on the ASA?
My CPU is back to normal now and the number of attacks went down to 2-3,,,
I hope somebody still can give me some pointers.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide