topic cannot block infected host in Network Security

cannot block infected host

lcaruso — Tue, 12 Mar 2019 01:31:43 GMT

Need some help.

I cannot block an internal host with an smtp virus with an ACL denying all ip from that host to any.

I assume this is because the connections are already established. I've tried clear local-host on that internal address but didn't help.

How do I stop a host with established connections?

Jouni Forss — Fri, 19 Apr 2013 13:53:32 GMT

Hi,

The ACL should be enough to block any new connections from the host towards any other interface on the ASA.

If you want to clear up a specific hosts connections then you could use

clear conn address

Or you can clear the translations for that host

clear xlate local

But to be honest I think the "clear local-host" command should already accomplish the same as above.

Have you confirmed that the block rule that you created is getting hits?

- Jouni

lcaruso — Fri, 19 Apr 2013 14:06:22 GMT

I tried clear-local host ip address all but the volume of traffic was so high it didn't stop everything until I used clear conn.

Thanks.