topic Re: Security Intelligence - Block List - Bogon in Network Security

Security Intelligence - Block List - Bogon

davidb84 — Wed, 10 Jun 2026 21:18:00 GMT

Does anyone know if it's normal for the Cisco Talos Feed to have 0 objects in the BOGON list? I found when mousing over the "Bogon" in the block list it shows 0 objects. In FMC, this is under Access Policy > Security Intelligence > Block List.

Security Intelligence feeds are downloading fine. I do have IPS licensing.

Re: Security Intelligence - Block List - Bogon

Kasun Bandara — Thu, 11 Jun 2026 03:20:41 GMT

@davidb84 hi, bogon is IP ranges which are not assigned to use in public ip space. not sure why talos showing 0 objects in it. but blocking this will help to avoid some attacker using illegitimate IP addresses to attack.

Re: Security Intelligence - Block List - Bogon

davidb84 — Thu, 11 Jun 2026 12:10:08 GMT

Would anyone have the ability to check their BOGON object and verify if it shows 0 objects as pictured above?

Re: Security Intelligence - Block List - Bogon

AigarsK — Thu, 11 Jun 2026 14:00:03 GMT

My cdFMC is also reporting 0 objects

Re: Security Intelligence - Block List - Bogon

Marvin Rhoads — Thu, 11 Jun 2026 17:23:37 GMT

The current SI feed appears to indeed have zero bogon addresses listed. I confirmed it on two separate FMCs.

You can verify the raw files under /var/sf/iprep_download in your FMC. That folder contains files for the various IP reputation feeds from TALOS. They all are named by UUIDs but you can check the mapping to human-readable name by looking at rep_dd.yaml. There you will see the various categories listed with their associated attributes. For example:

bogon: ID: 10 UUID: 5f8148f1-e5e4-427a-aa3b-ee1c2745c350 expiration: never long: IP Addresses that are known to not be allocated but are sending traffic short: Bogon Address

If we look at that file, we see just the header (with no addresses listed):

/var/sf/iprep_download$ cat 5f8148f1-e5e4-427a-aa3b-ee1c2745c350 #Cisco intelligence feed: Bogon

...matching the zero address shown in the FMC GUI.

Re: Security Intelligence - Block List - Bogon

davidb84 — Thu, 11 Jun 2026 17:36:48 GMT

So what's the correct way to block BOGONs if this feed is empty? Manually maintain a list?

Re: Security Intelligence - Block List - Bogon

Marvin Rhoads — Thu, 11 Jun 2026 17:42:18 GMT

I haven't read Cisco's rationale for having no addresses in the bogon category.

Normally I would expect the upstream ISP to block bogons in their router(s) eBGP configuration and thus you would never see them at your edge firewall. I suppose if you wanted, you could use a custom IP list and use that to block them as well.