🚀 go-pugleaf

We had no problems when our Fortinet firewall was handling duties with IDS/IPS services turned on, but as soon as we migrated the company over to an ASA 5520 two weeks ago, we all of a sudden were seeing single machines making over 50+ connections to Adobe update servers and slamming shut our Internet pipe (two T1's multi-linked). I enabled NetFlows on the I-Net router to see the top destinations and then had to setup an access list & capture on the ASA to find out who the requesting nodes were on our network. That is when I literally saw one computer take down I-Net for a 300+ user company. We have the Trend CSC-SSM piece installed and I backed off on the security settings to allow all file downloads, but it didn't make a difference. Trying to block servers other than on a temporary basis would not be smart since Adobe contracts with Level3 and others to host their content and media distributions.

Any info that any one has would be greatly appreciated by myself as well.

Thanks,
Terry