cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

485
Views
0
Helpful
1
Replies
Highlighted

Port Scan auto shun

Hello,

Any one configured ASA5585-X threat detection to auto shun IP Address which are doing port scan..

acl-deny is happening to ports which are not open. But i want to auto-shun the same

I have tried below  steps

threat-detection Basic-Threat

threat-detection rate scanning-threat rate-interval 600 average-rate 10 burst-rate 15

If i configure burst-rate to 0 it will trigger which is not acceptable-solution..

Regards,

-Danish

1 REPLY 1
Highlighted
Beginner

Hi,

What you did is just enabling basic threat detection. You have to also enable scanning threat detection and shunning hosts. You may want to configure a certain time during which shunned hosts will stay blocked. 

I suggest you check the following link it will help you a lot: link: http://www.cisco.com/c/en/us/td/docs/security/asa/asa80/configuration/guide/conf_gd/protect.html#wp1065813

-WA

Content for Community-Ad