topic Block country range of IP in Network Security

Block country range of IP

sangram palande — Mon, 11 Mar 2019 22:10:32 GMT

Hi,

I have a ASA 5510 device. I have been asked to block Ip range for India from accessing set of servers.

Total Subnets: 34,675,968

I really don't want to create a two mile long access list with all these subnets.

Is there a easier way of configuring this?

Thank you all. Ths forum is really awesome.

regards,

Block country range of IP

ajay chauhan — Thu, 05 Jan 2012 16:59:14 GMT

I don't think if there is any automated way to do it however under object group will have to call all the subnets if the ACL is too long and some kind of DoS attack is there will also impact performance. Hence instead of blocking should focus on what application/ports are getting expose to outside.

Thanks

Ajay

Block country range of IP

mvsheik123 — Thu, 05 Jan 2012 19:10:23 GMT

I concur with Ajay. Also, incase if the resources (or server) you are trying to protect by blocking range of IPs allows internet access from 'any' - talk to your systems admin to make sure the server gets up to date patches. To mitigate attacks from ASA end, refer to the below doc...

http://www.cisco.com/en/US/partner/products/ps6120/products_tech_note09186a00809763ea.shtml

hth