Scanning Attacks

[KSEyebank1]

I really know very little about firewalls, but noticed on the Firewall Dashboard we are seeing constant possible scanning attacks.  Is this normal?  If not what should I do about it?

[Vibhor Amrodia]

Hi,

Scanning attack detected (This option monitors scanning attacks; for example, the first TCP packet is not a SYN packet, or the TCP connection failed the 3-way handshake. Full scanning threat detection  takes this scanning attack rate information and acts on it by classifying hosts as attackers and automatically shunning them, for example. Incomplete session detection such as TCP SYN attack detected or no data UDP session attack detected.

So with Threat Detection enabled , you would see these stats increase for any drops which doesn't complete 3 Way Handshake.

Refer:-

http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/asdm64/configuration_guide/asdm_64_config/protect_threat.html

http://www.cisco.com/c/en/us/td/docs/security/asa/asa80/configuration/guide/conf_gd/protect.html#wp1072953

Thanks and Regards,

Vibhor Amrodia