Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

Duplicate TCP SYN

Support Community,

 

I've been trying to set up the following commands in my ASA5515 running ver. 9.125 for Duplicat TCP SYN Flood attacks. So I put in the default values that you find in the Cisco documentation but this didnt work for me to well. It slowed the internet down to a crawl and some pages like Cisco.com wouldnt even come up. Going to CNN about a quarter of the graphics would come up. I have an office of 25 people that Im trying to maintain a level of security for. I was wondering if you could direct me in the correct direction, or anybody out there that has enabled this for there network.

 

Thanks,

John W.

 

  1. Configuring the commands to help stop SYN Flood attack  or (DOS)

ciscoasa(config)#class-map tcp_syn

ciscoasa(config-cmap)#match port tcp eq 80

ciscoasa(config-cmap)#exit

ciscoasa(config)#policy-map tcpmap

ciscoasa(config-pmap)#class tcp_syn

ciscoasa(config-pmap-c)#set connection conn-max 100

ciscoasa(config-pmap-c)#set connection embryonic-conn-max 200

ciscoasa(config-pmap-c)#set connection per-client-embryonic-max 10

ciscoasa(config-pmap-c)#set connection per-client-max 10

ciscoasa(config-pmap-c)#set connection random-sequence-number enable

ciscoasa(config-pmap-c)#set connection timeout half-closed 0:0:30 embryonic 0:00:30 dcd 0:0:15 5 idle 1:0:0

ciscoasa(config-pmap-c)#set connection timeout tcp 1:0:0

ciscoasa(config-pmap-c)#exit

ciscoasa(config-pmap)#exit

ciscoasa(config)# service-policy tcpmap interface Internet_access

1 REPLY
Community Member

Hello, This can be that the

Hello,

 

This can be that the interface is not configure properly, ASA getting more traffic than it can handle it.

 

Can you send a show interface output?

 

Also see this post below.

 

https://supportforums.cisco.com/discussion/11557376/duplicate-tcp-syn-log-entries

 

If this is urgent matter to resolve I do suggest a case with Cisco TAC there are very familiar with this kind of issues.

Regards,

Erick Delgado

414
Views
0
Helpful
1
Replies
CreatePlease to create content