×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

PIX 525 firewall version 6.3(3) high CPU usage

Unanswered Question
Oct 31st, 2005
User Badges:

Dear guys,

I work as a Network Security Administrator for an ISP. We have two failover bundled PIX 525 firewalls with version 6.3(3). Recently the cpu usage of the firewall become nearly 100% denying accecss to our services from outside. After failing over to the secondary and performing sh conn command I see that there is a lot of DNS request to our DNS servers. I shutdown the secondary DNS and it seems the CPU usage of the firewall drops down a little bit. What is causing the high CPU usage? it this a DoS attack to our DNS?

Please help me on this.

regards,

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
sachinraja Wed, 11/02/2005 - 21:19
User Badges:
  • Red, 2250 points or more

Hello


Try to log these packets onto a syslog and see the source IP addresses. These can be some kind of Dos attacks... you need to analyse this traffic using some kind of an intrusion detection box.


Best thing is to block all unnecessary traffic on the perimeter router using access control lists. After that , include an IPS appliance which will monitor and block all kinds of attacks and vulnarabilities. YOu can probably look for an IPS 4215 or 4240. Doing this , you will maximise the security on your network.


HOpe this helps.. rate replies if found useful..


Raj

Actions

This Discussion