January 9, 2009 04:46am pst

1. MikeKane 4,500
2. lrmoore 3,500
3. decoleur 3,000
4. JFrederic... 2,500
5. keith_ala... 2,000
5. wacarr 2,000
7. grimkin 1,500
8. Cyclops3... 1,000
9. rsivanandan 500
10. batry_boy 260

1. lrmoore 1,569,423
2. keith_ala... 525,828
3. calvinetter 244,408
4. rsivanandan 230,838
5. tim_holman 196,866
6. nodisco 174,614
7. batry_boy 154,324
8. grblades 127,009
9. Voltz-dk 107,309
10. PeteLong 83,145
11. carribeant... 80,185
12. Cyclops3... 77,576
13. stressedo... 71,924
14. harbor235 63,105
15. srikrishnak 60,096
16. dpk_wal 56,500
17. pruecons... 55,203
18. jjoseph_x 48,002
19. billwharton 44,427
20. td_miles 43,372
21. RobWill 42,673
22. JFrederic... 42,100
23. MikeKane 39,028
24. ruddg 38,389
25. decoleur 35,186

07.16.2008 at 02:42PM PDT, ID: 23571419

	[x] Attachment Details

ASA 5510 - Help blocking TCP SYN packets

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

7.7

Zone:

Enterprise Firewalls

Tags:

Cisco, ASA, 5510

Can anyone help me to block all TCP SYN packets to a destination port on an ASA 5510?

(from our security scanner)
--
TCP Source Port Pass Firewall

THREAT:
Your firewall policy seems to let TCP packets with a specific source port pass through.

IMPACT:
Some types of requests can pass through the firewall. The port number listed in the results section of this vulnerability report is the source port that unauthorized users can use to bypass your firewall.

SOLUTION:
Make sure that all your filtering rules are correct and strict enough. If the firewall intends to deny TCP connections to a specific port, it should be configured to block all TCP SYN packets going to this port, regardless of the source port.

COMPLIANCE:
Not Applicable

RESULTS:
The host responded 4 times to 4 TCP SYN probes sent to destination port xx using source port 80.
However, it did not respond at all to 4 TCP SYN probes sent to the same destination port using a
random source port.

Start your 7 day free trial to see this answer

Answered By:	rsivanandan
Expert Since:	10/21/2003
Accepted Solutions:	1813
Computer Expertise:	Guru

rsivanandan has been an Expert for 5 years 2 months, during which he has posted 8037 comments and answered 1813 questions. rsivanandan is just one of 540 experts in the Enterprise Firewalls Zone. 1 expert collaborated on this answer, which was graded a "B" by the asker.

#	Title
1	Cisco ASA 5510 4000+ connec…
2	Does the ASA 5510 and ASA 55…
3	ASA 5505 Access Rules / NAT no…
4	New ASA 5505 doesn't allow https
5	ASA 5505 NAT issue
6	ASA + mss