I got a problem in the firewall network. One of the inside servers got virus and generated a huge TCP connections with other unknown hosts outside. Eventually, it depleted the connection resource and made the ASA5520 frozen. I had to disconnect that server from the network but it caused a service outage indeed.
Is there any way to prevent such issue on the firewall? Thank you.
In my opinion there is not whole a lot you can do in the firewall for this particular scenario, unless you know the ports and outside IP to block them, but even then it is hard to act quickly when you are trying to identify what's going on.
In your case you have an already infected system in the inside of your network that most of the time folks don't know how it got there, the connections are initiated from infected system inside to outside and firewall thinks is legit traffic ,unless you have other mechanisms in place internally,the internal network can still be vulnerable.NAC would have quarentine that system in an isolated VLAN for example.
Maybe I'm missing something, but have you looked into using the concurrent TCP connection limitation feature of static or dynamic NATs? I use this in our residential networks to limit tcp connections from our residents. The limitation implemented on a static would look something like this:
Use this with caution though. Based on the services that you offer from a server it could be possible for to exceed 100 concurrent connections under normal operation. Do some investigations before arbitrarily setting a limitation. Best of luck.
Hum, that parameter should help if it effects to outbound connection. I will check and test that though.
But I may not be able to apply it in PAT entry since it will block every inside servers.
configure mode commands/options:
<0-65535> The maximum number of simultaneous TCP connections the local IP hosts are to allow, default is 0 which means unlimited connections. Idle connections are closed after the time specified by the timeout conn command
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...