DDOS DNS

Question

Experiencing what I believe are DDOS attacks on an ASA5510 running Ver 8.3(2)
I have set up threat detection and shunning
threat-detection basic-threat
threat-detection scanning-threat shun duration 36000
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 15 burst-rate 25 average-rate 25
dynamic-filter use-database
dynamic-filter enable
dynamic-filter drop blacklist
policy-map Outside-policy
class Outside-class
  inspect dns dynamic-filter-snoop
  set connection conn-max 20 embryonic-conn-max 10 per-client-max 10 per-client-embryonic-max 5
  set connection timeout idle 1:00:00 reset
class Outside-class1
  inspect dns dynamic-filter-snoop
  set connection conn-max 20 embryonic-conn-max 10 per-client-max 10 per-client-embryonic-max 10
  set connection timeout idle 1:00:00 reset
threat-detection basic-threat
threat-detection scanning-threat shun duration 36000
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 15 burst-rate 25 average-rate 25
dynamic-filter use-database
dynamic-filter enable
dynamic-filter drop blacklist
created a policy-map  
policy-map Outside-policy
class Outside-class
  inspect dns dynamic-filter-snoop
  set connection conn-max 20 embryonic-conn-max 10 per-client-max 10 per-client-embryonic-max 5
  set connection timeout idle 1:00:00 reset
class Outside-class1
  inspect dns dynamic-filter-snoop
  set connection conn-max 20 embryonic-conn-max 10 per-client-max 10 per-client-embryonic-max 10
  set connection timeout idle 1:00:00 reset
1.) Are these looking correct?
2.) Is there anything else that I can do via configuration that would ameliorate these attacks?          
3) Is there anything else besides looking into getting AIP-SSM?
TIA for any assistance

Answer 1

Hello.
As a DDOS prevention you may use either a DDOS prevention service from third party, or just try to protect your subnets/hosts with 
Remote Triggered Black Hole Filtering
https://tools.ietf.org/html/rfc5635
Also if you faced any issue with network link utilization (inside your network) - deploy QoS or upgrade the links.
PS: I wonder where you were not able to access your BGP routers?! Are they not fast enough to process 1G of data? Don't you protect management and control plane on the network devices?