Multi port scanning from outside

[mx]

Hello, I am running an ASA 5505 with 8.2(2) ios. I am running a very simple web server inside on port 80 and more importantly an email server.

When I check my IIS logs for the web server I see countless attempts by hackers to gain access to phpMyAdmin etc etc which I am not running. I have been safe so far.

My question is, these hacking attempts are clearly from the same person as they come in huge batches, but their source IP address changes with each attempt. Obviously I cant block by IP address, and that would be a full time job anyway.  Is there another way to block such attempts? Say after 2 attempts at a certain URL they are automatically blacklisted, or any php attempts would be blacklisted.

Thank you for any input!

Bob

[Collin Clark · Accepted solution]

Bob-

You would need something with a little more intelligence like IPS. You can setup rules to do exactly that. Unfortunately the ASA can't do that out-of-the-box. If you would like to explore that further take a look at Cisco's Sourcefire solution. It's an IPS that runs on the ASA (must be on the new ASA-X model though). Let us know if you have any other questions.

Hope it helps.

[mx]

Thank you sir. I kind of figured that was the case, but thought Id take a chance.

bob