ASA Risk:Spoofed EIGRP Packet Saturation DoS

Question

We have detected a high risk in asa5510.
risk information:
Port:22 TCP - ssh
Script Id: 
Name:Cisco IOS: Spoofed EIGRP Packet Saturation DoS
Risk Score:7.8(High risk)
Product:Cisco IOS
Extended Interior Gateway Routing Protocol (EIGRP), as implemented in Cisco IOS 11.3 through 12.2 and other products, allows remote attackers to cause a denial of service (flood) by sending a large number of spoofed EIGRP neighbor announcements, which results in an ARP storm on the local network.
Device details:
verson:8.6
no EIGRP session
Does Cisco have any solutions to close this risk? 

Answer 1

Hi ,
Is ASA  detected this for your network or for the ASA itself? if it's a router/L3 switch you can mitigate this threat by limiting interfaces(hard coding network command to the interface ip address)  that participate in eigrp routing ( you don't want to listen eigrp packets on the interfaces that you don't want to have eigrp neighbor-ship)
HTH
Murali.