Oh, well that changes things. I don't mean to make excuses for Cisco, but the only TCP sessions TO the ASA should be from specific hosts or segments that are considered "safe" or "clean" such as a management subnet. In all likelihood, if your management stations are compromised you're screwed anyway, as they most certainly have the credentials and access rights to manage any of your network devices.
If access into your ASA is wide-open, I'd suggest that you have more serious, policy based, issues. Fred Reimer, CISSP, CCNP, CQS-VPN, CQS-ISS Senior Network Engineer Coleman Technologies, Inc. 954-298-1697 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Peter Rathlev Sent: Monday, June 09, 2008 4:57 AM To: Luan M Nguyen Cc: cisco-nsp Subject: Re: [c-nsp] configuring RFC1948 on the ASA 5505 On Sat, 2008-06-07 at 22:58 -0400, Luan M Nguyen wrote: > I wonder if you do this: > class-map tcp_traffic > match any > policy-map global_policy > class tcp_traffic > set connection random-sequence-number disable > > Would you get TCP Sequence Prediction: Difficulty=0 (Trivial joke)? Well, I tried that now, but it doesn't change the result. The above is about randomizing TCP sequence numbers for connections passing _through_ the ASA. It doesn't change anything for connections with the ASA as one endpoint. Regards, Peter _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
