Network Management

Shadow Rules triggered security alert for Cisco ASA node in NCM

After adding a Cisco ASA Node to NCM, a firewall security alert fires for Shadow Rule detection.

First published date

11/12/2021 12:26 AM

Last published date

2/11/2025 2:26 PM

Overview

NCM has built-in functionality for Shadow Rule Detection on Cisco ASA ACL.
This functionality can trigger a lot of DNS requests.
This activity may become suspicious for security scans, and trigger Security Alert.

Product section

Network Configuration Manager

Cause

The NCM Shadow Rule Detection feature, when parsing the ACLs, will perform a DNS Lookup of hosts. If the host cannot be resolved, the results are not cached, and the DNS Lookup is performed again, which can lead to an antivirus treating it suspiciously and flagging it.

Resolution

There are two options to prevent this.

The first option is to disable ACL Shadow Rule Detection altogether in the Centralized Settings page of the Orion Web Console. This option should be use if there are no need for the feature:

  1. Log in to the Orion Web Console using an account with administrative privileges.
  2. To access Advanced Configuration Settings, copy /Admin/AdvancedConfiguration/Global.aspx.
  3. Paste it into your browser address bar, after /Orion, as shown here: <your production server>/Orion/Admin/AdvancedConfiguration/Global.aspx
  4. Search for " AclShadowRuleDetectionDisabled", Check the box and Save the changes.

EXTRA STEP-.png

The second option is to keep the ACL Shadow Rule Detection feature but disable the DNS Lookup. This setting is in the same section as option 1:

image-20220916-142304.png