Cisco Systems ASA 5580 Configuring Scanning Threat Detection, Average Rate Burst Rate, 27-10

Chapter 27 Configuring Threat Detection

Configuring Scanning Threat Detection

Default Settings

Table 27-4lists the default rate limits for scanning threat detection.

Table 27-4 Default Rate Limits for Scanning Threat Detection

Average Rate	Burst Rate
5 drops/sec over the last 600 seconds.	10 drops/sec over the last 20 second period.
5 drops/sec over the last 3600 seconds.	10 drops/sec over the last 120 second period.

The burst rate is calculated as the average rate every N seconds, where N is the burst rate interval. The burst rate interval is 1/30th of the rate interval or 10 seconds, whichever is larger.

Configuring Scanning Threat Detection

Detailed Steps

Step 1 Choose the Configuration > Firewall > Threat Detection pane, and check the Enable Scanning Threat Detection check box.

Step 2 (Optional) To automatically terminate a host connection when the ASA identifies the host as an attacker, check the Shun Hosts detected by scanning threat check box.

Step 3 (Optional) To except host IP addresses from being shunned, enter an address in the Networks excluded from shun field.

You can enter multiple addresses or subnets separated by commas. To choose a network from the list of IP address objects, click the ... button.

Step 4 (Optional) To set the duration of a shun for an attacking host, check the Set Shun Duration check box and enter a value between 10 and 2592000 seconds. The default length is 3600 seconds (1 hour). To restore the default value, click Set Default.

Cisco ASA Series Firewall ASDM Configuration Guide

27-10