topic Re: auto blocking IP after alert/ event in Network Security

auto blocking IP after alert/ event

paul-d — Fri, 21 Feb 2020 15:07:24 GMT

Hi,

Can firepower / firesight, auto block an IP address if the IP generates an event or an alert. So rather than constantly blocking the attack, i would like FP to actually block the a fending IP for a set period.

Re: auto blocking IP after alert/ event

Marvin Rhoads — Wed, 17 Jan 2018 15:16:06 GMT

Not by itself it cannot.

If the offending host is internal and you have something like ISE you can create a correlation policy to have ISE quarantine the host or shutdown the switchport or kick it off the WLAN.

Re: auto blocking IP after alert/ event

paul-d — Tue, 23 Jan 2018 09:58:57 GMT

Hi,

Thank you, i dont suppose you have any links to any sources? at all

kind regards

Chris.

Re: auto blocking IP after alert/ event

Marvin Rhoads — Tue, 23 Jan 2018 13:21:35 GMT

You're welcome.

The Cisco solution is known as Rapid Threat Containment. More information can be found here:

https://www.cisco.com/c/en/us/solutions/enterprise-networks/rapid-threat-containment/index.html

Re: auto blocking IP after alert/ event

Chess Norris — Tue, 30 Jan 2018 13:32:58 GMT

While the Rapid Threat Containment working fine for quarantine endpoints in ISE , I am struggling to find a good solution for un-quarantine. Do you know if is is possible to use the FMC REST API to un-quarantine an endpoint based on MAC or IP address?

Thanks

/Jorgen

Re: auto blocking IP after alert/ event

Marvin Rhoads — Tue, 30 Jan 2018 14:46:35 GMT

Assuming ISE quarantined the endpoint, it can also unquarantine it and send a message via pxGrid for Firepower to do the same.

I'm not sure about using the API directly. Even if the documentation told me I could use the API, I would lab that up first.