cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

150
Views
0
Helpful
2
Replies
mx
Beginner
Beginner

Multi port scanning from outside

Hello, I am running an ASA 5505 with 8.2(2) ios. I am running a very simple web server inside on port 80 and more importantly an email server.

When I check my IIS logs for the web server I see countless attempts by hackers to gain access to phpMyAdmin etc etc which I am not running. I have been safe so far.

 

My question is, these hacking attempts are clearly from the same person as they come in huge batches, but their source IP address changes with each attempt. Obviously I cant block by IP address, and that would be a full time job anyway.  Is there another way to block such attempts? Say after 2 attempts at a certain URL they are automatically blacklisted, or any php attempts would be blacklisted.

 

Thank you for any input!

Bob

 

1 ACCEPTED SOLUTION

Accepted Solutions
Collin Clark
Advisor

Bob-

You would need something with a little more intelligence like IPS. You can setup rules to do exactly that. Unfortunately the ASA can't do that out-of-the-box. If you would like to explore that further take a look at Cisco's Sourcefire solution. It's an IPS that runs on the ASA (must be on the new ASA-X model though). Let us know if you have any other questions.

 

Hope it helps.

View solution in original post

2 REPLIES 2
Collin Clark
Advisor

Bob-

You would need something with a little more intelligence like IPS. You can setup rules to do exactly that. Unfortunately the ASA can't do that out-of-the-box. If you would like to explore that further take a look at Cisco's Sourcefire solution. It's an IPS that runs on the ASA (must be on the new ASA-X model though). Let us know if you have any other questions.

 

Hope it helps.

View solution in original post

Thank you sir. I kind of figured that was the case, but thought Id take a chance.

bob

Content for Community-Ad