topic Block IP address from Outside interface in Network Security

Block IP address from Outside interface

SamMooreIT — Mon, 11 Mar 2019 20:50:12 GMT

Hello.

Recently, I've been having significant problems with denial of service on our ASA-5510. Two IP addresses in particular attack my ASA regularly. What kind of rule do I need to create to deny these IP's access to my firewall?

Thanks!

Sent from Cisco Technical Support iPhone App

Block IP address from Outside interface

Kelvin Willacey — Fri, 24 Jun 2011 15:09:35 GMT

What type of attack?

Re: Block IP address from Outside interface

SamMooreIT — Fri, 24 Jun 2011 15:46:04 GMT

Either a Scan or SYN attack. But the IP's in question are generating significant inbound traffic. They are listed in top 10 sources pie of my ASDM GUI.

Sent from Cisco Technical Support iPhone App

Block IP address from Outside interface

advijay — Fri, 24 Jun 2011 15:50:10 GMT

Hey Josh,

If you don't want any connection to estaiblish from two known IP addresses, you may go ahead and "shun" them. The command to do this will look like:

hostname# shun

Hope this helps!

Regards,

Aditya

Block IP address from Outside interface

andhingr — Fri, 24 Jun 2011 18:05:01 GMT

Since the attack has already taken place. If you are not allowing these IPs ASA will be blocking them anyways. The best course of action will be to have it blocked upstream and if upstream is your service provider then talk to provider to have the IPs blocked on upstream.