# Does Cisco ASA firewall provide DDoS protection?

**URL:** <https://forum.networklessons.com/t/does-cisco-asa-firewall-provide-ddos-protection/15542>\
**Category:** ASA\
**Created:** [October 10, 2021, 3:52pm UTC](https://forum.networklessons.com/t/does-cisco-asa-firewall-provide-ddos-protection/15542 "2021-10-10T15:52:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![shivani.bsc29](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/s/b487fb/32.png) [@shivani.bsc29](https://forum.networklessons.com/u/shivani.bsc29)\
**Post date:** [October 10, 2021, 3:52pm UTC](https://forum.networklessons.com/t/does-cisco-asa-firewall-provide-ddos-protection/15542/1 "2021-10-10T15:52:11Z")

</div>

Hi, I would like to know whether the cisco ASA firewall provide the DDoS protection ? If yes, then how & if no, then request you to suggest the solution that we can use along with the existing ASA firewall in place ?

---

<div class="post-metadata">

**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\
**Post date:** [October 12, 2021, 9:00am UTC](https://forum.networklessons.com/t/does-cisco-asa-firewall-provide-ddos-protection/15542/2 "2021-10-12T09:00:30Z")

</div>

Hello Shivani

The ASA provides basic DoS attack detection by monitoring the rates at which packets are dropped for various reasons. It generates statistics that can then be analyzed, and the type of attack being experienced can be determined. For information about this feature, take a look at the following documents:

> **[CLI Book 2: Cisco ASA Series Firewall CLI Configuration Guide, 9.8 - Threat...](https://www.cisco.com/c/en/us/td/docs/security/asa/asa98/configuration/firewall/asa-98-firewall-config/conns-threat.html#ID-2132-000000e5)**
>
> Threat Detection

> **[Ascertain ASA Threat Detection Functionality and Configuration](https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113685-asa-threat-detection.html)**
>
> This document describes the three main components of threat detection functionality and configuration.

Now distributed DoS attacks (DDoS) are a different story. Because these are by definition distributed, it is not possible for an ASA to detect them, let alone protect against them, because of the fact that there are many different sources of such attacks by the “distributed” definition. In order to achieve this, you would need to use a Next-Generation FireWall (NGFW) such as Cisco [FirePower](https://www.cisco.com/c/en/us/products/security/secure-ddos-protection/index.html) or similar products from other vendors.

I hope this has been helpful!

Laz

---

<div class="post-metadata">

**Author:** ![shivani.bsc29](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/s/b487fb/32.png) [@shivani.bsc29](https://forum.networklessons.com/u/shivani.bsc29)\
**Post date:** [October 13, 2021, 1:15am UTC](https://forum.networklessons.com/t/does-cisco-asa-firewall-provide-ddos-protection/15542/3 "2021-10-13T01:15:13Z")

</div>

Thanks for the clarification.