Problems with ASA 8.4 event type 500004

[Luis Perez]

I have two ASA 5585 in an active/standby cluster, i have had this problem two times in the last week.

We had problems with the physical network interface card in two servers and these servers started to send an anomalous traffic recognized in my Cisco Security Manager like an event type 500004. The ASA cluster went unavailable like it was suffering an DoS attack, i have an IPS in each ASA and i think it is responsible to control this type of traffic.

Somebody have any idea about a solution for this problem??, I need to control this problem.

[Amjad Abdullah]

Luis:
I guess you are in the wrong corner. This is security sub-forum under Wireless forums.
you better move the thread to the security main forums.

Nice to catch you in our place though.

Buy a wireless device and come anytime if you need help

Amjad

You want to say "Thank you"?
Don't. Just rate the useful answers,
that is more useful than "Thank you".

[Julio Carvajal]

Hello Luis,

can you explain whitch device has the 129.125 ip address.

Regards,

Julio

[Luis Perez]

I don't know which device is this IP i think this is an attacker, but i don´t know why my IPS doesn't drop this traffic. Yesterday I have made configurations in my IPS and i hope this work if this kind of attack start again.

[Julio Carvajal]

Hello Luis,

Hope so, let us know what happens.

Also if this does not work please send us a good picture of the log you are receving as at least I cannot read it well ( with my glasses on )

Regards

Julio