Deny TCP (no connection) flag SYN ACK on interface outside

[PhamTuan42019]

Hi all,

I'm using ASA 5520, and this morning my ASA generate too many log (thousands log), such as:

Deny TCP (no connection) from 192.175.23.38/80 to 103.X.X.109/23518 flags SYN ACK on interface OUTSIDE

Deny TCP (no connection) from 119.209.253.109/7547 to 103.X.X.228/3987 flags SYN ACK on interface OUTSIDE

Deny TCP (no connection) from 87.128.101.69/5060 to 103.X.X.169/43179 flags SYN ACK on interface OUTSIDE

Deny TCP (no connection) from 45.60.133.51/25 to 103.X.X.128/1774 flags SYN ACK on interface OUTSIDE

My DMZ range IP is 103.X.X.0/24, and logs contain many ip in this range, but these ips have not be assigned for any server.

I don't know routing is incorrect or my system is under Syn Attack.

Please give me some suggest for this situation

[rais · Accepted solution]

If you aren't using any of these IPs you should consider putting a 103.x.x.x/24 null0 route on your border router/firewall.

HTH.