topic Re: denying attacking IP on PIX in Network Security

denying attacking IP on PIX

edgrant — Fri, 21 Feb 2020 06:17:22 GMT

can someone please confirm or correct me on this. i have an IP addy that has been scanning my network off/on for a few hours. i have already contacted the administrator for this IP's network(a college campus) via email and left him a voicemail, but have not heard back yet. i want to completely deny this IP until i have spoken with this admin and addressed this issue. i am not positive that i am entering the correct command, so if someone could confirm the command i would appreciate it. TIA

access-list 110 deny tcp host x.x.x.x any

Re: denying attacking IP on PIX

steve.barlow — Mon, 07 Oct 2002 18:43:11 GMT

Use IP, not just tcp: "access-list 110 deny ip host x.x.x.x any"

Also look into the "shun" command: http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/cmdref/s.htm#xtocid20 .

Use the "icmp" command if you want your PIX to not be pinged (can block all icmp as well) any more as well: http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/cmdref/gl.htm#xtocid5 .

Hope it helps.

Steve

Re: denying attacking IP on PIX

nnorthedge — Mon, 07 Oct 2002 18:47:37 GMT

For the access list you may want to deny ip, instead of just tcp. You'll also need to apply the access list to the interface:

access-group 110 in interface outside

You can only have one access list applied to an interface at a time, so if you already have one on the outside interface, you'll have to combine the two.

Norman