You can read more about it on the links below, there are some suggestions. Please be aware that I have not yet tested it myself on any ASA that is in production so I don't know how well the suggestions actually work.
"Mitigation Different kinds of mitigations can be implemented to minimise the impact of the attack. On firewalls and other kinds of equipment a list of trusted sources for which ICMP is allowed could be configured. Disabling ICMP Type 3 Code 3 on the WAN interface can mitigate the attackquite easily. This is the best mitigation weknow of so far."
This seems to be affecting all ASAs, we ran those tests yesterday and a 5545 increased to 42% CPU and a 5585 ssp20 took a 9% cpu-hit from just one computer with the same test. The fewer cores your ASA has the worse the impact seems to be.
If you are under attack I think your best bet is to filter it out further out in the network. I.e. configure a PACL on a switch between your ISP and your ASA that blocks icmp unreachable before it hits your ASA, that is until the original issue has been solved properly.
If WSA stopped responding to Web requests and a reboot fixed it ... may be also if Cisco TAC confirmed you are hit with the Bug CSCve59632
Cisco Bug CSCve59632 affects WSA, As when Certain number o...
This document describes how to configure a site-to-site (LAN-to-LAN) IPSec IKE Version 1 (IKEv1) tunnels using Virtual Tunnel Interface (VTI) between two Cisco ASA. ASA VPN module was enhanced with this logical interface in version 9.7(1) and...
Helps meet PCI compliance.
Threat protection built into ISR and ISRv branch routers and CSR
Complements ISR Integrated Security
Lightweight IPS solution with low TCO (Total Cost of Ownership) and automated s...