01-19-2015 06:47 AM - edited 03-11-2019 10:21 PM
Hello, I am running an ASA 5505 with 8.2(2) ios. I am running a very simple web server inside on port 80 and more importantly an email server.
When I check my IIS logs for the web server I see countless attempts by hackers to gain access to phpMyAdmin etc etc which I am not running. I have been safe so far.
My question is, these hacking attempts are clearly from the same person as they come in huge batches, but their source IP address changes with each attempt. Obviously I cant block by IP address, and that would be a full time job anyway. Is there another way to block such attempts? Say after 2 attempts at a certain URL they are automatically blacklisted, or any php attempts would be blacklisted.
Thank you for any input!
Bob
Solved! Go to Solution.
01-19-2015 10:21 AM
Bob-
You would need something with a little more intelligence like IPS. You can setup rules to do exactly that. Unfortunately the ASA can't do that out-of-the-box. If you would like to explore that further take a look at Cisco's Sourcefire solution. It's an IPS that runs on the ASA (must be on the new ASA-X model though). Let us know if you have any other questions.
Hope it helps.
01-19-2015 10:21 AM
Bob-
You would need something with a little more intelligence like IPS. You can setup rules to do exactly that. Unfortunately the ASA can't do that out-of-the-box. If you would like to explore that further take a look at Cisco's Sourcefire solution. It's an IPS that runs on the ASA (must be on the new ASA-X model though). Let us know if you have any other questions.
Hope it helps.
01-19-2015 10:24 AM
Thank you sir. I kind of figured that was the case, but thought Id take a chance.
bob
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide