Cisco ASA Series Configuration Guide

CHAPTER
18-1
Cisco ASA Series Firewall CLI Configuration Guide
18
Threat Detection
This chapter describes how to configure threat detection statistics and scanning threat detection.
• Detecting Threats, page 18-1
• Guidelines for Threat Detection, page 18-3
• Defaults for Threat Detection, page 18-4
• Configure Threat Detection, page 18-4
• Monitoring Threat Detection, page 18-8
• Examples for Threat Detection, page 18-13
• History for Threat Detection, page 18-14
Detecting Threats
Threat detection on the ASA provides a front-line defense against attacks. Threat detection works at
Layer 3 and 4 to develop a baseline for traffic on the device, analyzing packet drop statistics and
accumulating “top” reports based on traffic patterns. In comparison, a module that provides IPS or Next
Generation IPS services identifies and mitigates attack vectors up to Layer 7 on traffic the ASA
permitted, and cannot see the traffic dropped already by the ASA. Thus, threat detection and IPS can
work together to provide a more comprehensive threat defense.
Threat detection consists of the following elements:
• Different levels of statistics gathering for various threats.
Threat detection statistics can help you manage threats to your ASA; for example, if you enable
scanning threat detection, then viewing statistics can help you analyze the threat. You can configure
two types of threat detection statistics:
– Basic threat detection statistics—Includes information about attack activity for the system as a
whole. Basic threat detection statistics are enabled by default and have no performance impact.
– Advanced threat detection statistics—Tracks activity at an object level, so the ASA can report
activity for individual hosts, ports, protocols, or ACLs. Advanced threat detection statistics can
have a major performance impact, depending on the statistics gathered, so only the ACL
statistics are enabled by default.
• Scanning threat detection, which determines when a host is performing a scan. You can optionally
shun any hosts determined to be a scanning threat.

Cisco ASA Series Specifications

General

Brand	Cisco
Model	ASA Series
Category	Network Hardware
Language	English