Peak bandwidth utilization problem

[rahil khan]

Dear ALL,

I am facing issue of high bandwidth utilization issue at customer site. And don't know how to address this issue. Customer having cisco asa deployed at perimeter. I am looking at firewall there are lot of attacks hitting firewall. like 445, 25, and others using higher port numbers. Then I applied access list to mitigate this problem and was done successfully. But bandwidth is on peak. How to stop this????

[mirober2]

Hi Rahil,

Unfortunately, there is nothing you can do from the firewall side besides blocking the packets in an ACL or shunning the attacker's source IP(s). However, as you've found, even if the packets are blocked by the ASA, they will still utilize bandwidth on your Internet link.

You would need to contact your ISP and ask them to stop this attack somewhere upstream on their infrastructure. They can blackhole the attacker's packets so that they never even reach your network. This is the only true way to stop attackers from overutilizing your bandwidth. Once the packets travel down the wire and reach your ASA, the bandwidth has already been used at that point.

Hope that helps.

-Mike