The Cisco ASA must be configured to implement scanning threat detection.
An XCCDF Rule
Description
<VulnDiscussion>In a port scanning attack, an unauthorized application is used to scan the host devices for available services and open ports for subsequent use in an attack. This type of scanning can be used as a DoS attack when the probing packets are sent excessively.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-239864r891328_rule
- Severity
- High
- References
- Updated
Remediation - Manual Procedure
Configure scanning threat detection as shown in the example below.
ASA(config)# threat-detection scanning-threat shun