topic IP Blocking on FMC/FTD in Network Security

IP Blocking on FMC/FTD

kostasthedelegate — Wed, 18 Nov 2020 09:29:55 GMT

Hello,

I would like to block some public IP addresses in the FMC in a manual way.

When I see it in the events I have the option to select to blacklist it.

When I go to that blacklist I cannot add manually.

Which is the best way to block a public IP?

Regards,

Konstantinos

Re: IP Blocking on FMC/FTD

Rob Ingram — Wed, 18 Nov 2020 09:51:45 GMT

Hi @kostasthedelegate

You could create a manual list, define the IP addresses you wish to block and reference that list in the ACP as a blacklist. You'd need to manually download the list and re-upload to modify.

HTH

Re: IP Blocking on FMC/FTD

kostasthedelegate — Wed, 18 Nov 2020 14:14:25 GMT

Hello @Rob Ingram

In the access policy you mean the URL tab?

Would it be better to use DNS policy?

What is the order the traffic flows in the FTD in order to cut the desired traffic as soon as possible?

Re: IP Blocking on FMC/FTD

Rob Ingram — Wed, 18 Nov 2020 14:26:33 GMT

No under the SI tab of the ACP, select the list and add to the blacklist. Screenshot below shows which is blocked first.

Re: IP Blocking on FMC/FTD

kostasthedelegate — Wed, 18 Nov 2020 14:29:49 GMT

Thank you Rob

I will test it!!

Re: IP Blocking on FMC/FTD

kostasthedelegate — Thu, 19 Nov 2020 10:08:02 GMT

Hello

We tested it and we get that 0 IP found

Could you point me to the syntax of the file the list should contain?

Regards,

Konstantinos

Re: IP Blocking on FMC/FTD

Rob Ingram — Thu, 19 Nov 2020 10:19:55 GMT

The list just needs to contain the IP address(es) you wish to block.

Re: IP Blocking on FMC/FTD

kostasthedelegate — Thu, 19 Nov 2020 10:48:01 GMT

I tried putting the IP only and it said It found 0 IPs

Re: IP Blocking on FMC/FTD

Rob Ingram — Thu, 19 Nov 2020 11:51:08 GMT