topic Hi,Then , don't use this at in Network Security

ASA null0 route question

Machi Ma — Tue, 12 Mar 2019 05:03:50 GMT

Hello,

It looks that there are no null route function in earlier version of ASA. Just today when checking with 9.x it have null0 route now

Ref:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/general/asa-general-cli/route-static.html#pgfId-1254465

I would like to check is it like following setup.

Source IP: 172.0.10.11

and need to black-hole it

so it should be like following?

route null0 172.0.10.11 255.255.255.255

Thanks!

Hi,Null route will help you

Vibhor Amrodia — Wed, 12 Nov 2014 10:25:06 GMT

Hi,

Null route will help you to Black Hole for a specific Destination IP and not the sources.

For Ex:-

route null0 172.0.10.11 255.255.255.255

This will drop all the traffic going to 172.0.10.11

Thanks and Regards,

Vibhor Amrodia

Hi,Thanks for advise. How

Machi Ma — Thu, 13 Nov 2014 05:00:46 GMT

Hi,

Thanks for advise. How about if I create the dummy interface

example

interface ethernet0/1.1000

description Black Hole dummy interface

nameif bh0

security-level 100

ip address 10.0.0.1 255.255.255.252

Then I add static route to this interface

route bh0 172.0.10.11 255.255.255.255 10.0.0.1 255

Since I could not have control of Router end, so my propose is want to save some power of ASA for building some ACL to block those IPs and save some log space.

Thanks!

Hi,I think Null route would

Vibhor Amrodia — Thu, 13 Nov 2014 05:15:16 GMT

Hi,

I think Null route would be better way to do it than this.

Also , if you want some traffic destined to IP:- 172.0.10.11 to be blackholed , you can add a dummy route as well pointing next hop to an Unused IP in the Subnet and that would also achieve the same results for you.

Thanks and Regards,

Vibhor Amrodia

Hi,Thanks but IP:- 172.0.10

Machi Ma — Thu, 13 Nov 2014 05:34:48 GMT

Hi,

Thanks but IP:- 172.0.10.11 is source incoming toward to firewall. Which I want to blackholed it.

Thanks!

Hi,Then , don't use this at

Vibhor Amrodia — Thu, 13 Nov 2014 05:40:50 GMT

Hi,

Then , don't use this at all as this will not work.

Use SHUN instead.

Thanks and Regards,

Vibhor Amrodia