>[оверквотинг удален]
> 6 Jun 07 2012 16:02:10 302014 31.192.16.162 52765 10.205.10.2 80 Teardown TCP
> connection 183808 for outside:31.192.16.162/52765 to inside: 10.205.10.2/80 duration
> 0:01:05 bytes 30142 TCP FINs
> Это IPTables
> Jun 7 16:02:19 web kernel: ip_conntrack: table full, dropping packet.
> Jun 7 16:02:27 web kernel: printk: 219 messages suppressed.
> В логах Nginx нашел множество HTTP Get request....
> Но есть проблема - нет дополнительных модулей...
> Версия ASA 8.2(1)
> Лицензия - Security Plus Самостоятельно (что нашел) настройл следующее:
threat-detection rate dos-drop rate-interval 600 average-rate 2 burst-rate 2
threat-detection rate dos-drop rate-interval 3600 average-rate 2 burst-rate 2
threat-detection rate bad-packet-drop rate-interval 600 average-rate 2 burst-rate 2
threat-detection rate bad-packet-drop rate-interval 3600 average-rate 2 burst-rate 2
threat-detection rate conn-limit-drop rate-interval 600 average-rate 3 burst-rate 3
threat-detection rate conn-limit-drop rate-interval 3600 average-rate 3 burst-rate 3
threat-detection rate scanning-threat rate-interval 600 average-rate 2 burst-rate 2
threat-detection rate scanning-threat rate-interval 3600 average-rate 2 burst-rate 2
threat-detection rate syn-attack rate-interval 600 average-rate 2 burst-rate 2
threat-detection rate syn-attack rate-interval 3600 average-rate 2 burst-rate 2
threat-detection rate inspect-drop rate-interval 600 average-rate 2 burst-rate 2
threat-detection rate inspect-drop rate-interval 3600 average-rate 2 burst-rate 2
threat-detection basic-threat
threat-detection scanning-threat shun duration 600
threat-detection statistics
threat-detection statistics host number-of-rate 2
threat-detection statistics tcp-intercept rate-interval 15 burst-rate 30 average-rate 30
class-map HTTP
match port tcp eq www
class-map TCPNORM
match any
class-map CONNS
match any
class-map inspection_default
match default-inspection-traffic
class-map HTTP_1
match port tcp eq www
policy-map type inspect http HTTP_1
parameters
protocol-violation action drop-connection log
match request header content-length length gt 256
drop-connection log
policy-map CONNS
class CONNS
set connection conn-max 1024 embryonic-conn-max 128 per-client-max 254 per-client-embryonic-max 3
set connection timeout embryonic 0:00:05 half-closed 0:05:00 tcp 0:30:00 reset dcd 0:00:05 3
class TCPNORM
set connection advanced-options TCPNORM
class HTTP_1
inspect http HTTP_1
service-policy CONNS interface outside
Сможете указаь, что еще можно настройть, или куда рыть?
С уважением!
Вариант для распечатки
