topic Re: Best way to block IPs in Network Security

Best way to block IPs

CiscoBrownBelt — Fri, 21 Feb 2020 17:08:18 GMT

If you need to block IDK malicious IPs and what not, obviously the list could grow very large over time. Also, I know simply blocking a targeted attack may not be effective at preventing DOS/DDOS etc. What would be the best ways to block IPs on lets say an ASA. Would an IPS/IDS be the better solution to implement when it comes to this?

Re: Best way to block IPs

Marius Gunnerud — Wed, 15 May 2019 20:05:25 GMT

The best way to block malicious traffic is to use an IPS. But if you insist on using the ASA you could use the botnet filter feature.

https://www.cisco.com/c/en/us/td/docs/security/asa/special/botnet/guide/asa-botnet.html

Re: Best way to block IPs

venkat_n7 — Thu, 16 May 2019 04:32:46 GMT

I would agree with @Marius Gunnerud . but just an HeadsUP! with ASA , if you use that feature on ASA it eats all memory/processing i tried on 5510.

Re: Best way to block IPs

CiscoBrownBelt — Fri, 17 May 2019 15:45:27 GMT

Awesome thanks!

Re: Best way to block IPs

CiscoBrownBelt — Fri, 17 May 2019 15:46:38 GMT

Yes I would nee to test so I am not sure I can use it if that is the case.

Re: Best way to block IPs

CiscoBrownBelt — Fri, 17 May 2019 15:54:06 GMT

Looks like I don't have that option on my ASA Firepower
ASDM—the Configuration > Firewall > Botnet Traffic Filter > Botnet Database pane Purge Botnet Database button.