Best way to block IPs

[CiscoPurpleBelt]

If you need to block IDK malicious IPs and what not, obviously the list could grow very large over time. Also, I know simply blocking a targeted attack may not be effective at preventing DOS/DDOS etc. What would be the best ways to block IPs on lets say an ASA. Would an IPS/IDS be the better solution to implement when it comes to this?

[Marius Gunnerud · Accepted solution]

The best way to block malicious traffic is to use an IPS.  But if you insist on using the ASA you could use the botnet filter feature.

https://www.cisco.com/c/en/us/td/docs/security/asa/special/botnet/guide/asa-botnet.html

[CiscoPurpleBelt]

Looks like I don't have that option on my ASA Firepower
ASDM—the Configuration > Firewall > Botnet Traffic Filter > Botnet Database pane Purge Botnet Database button.

[venkat_n7 · Accepted solution]

I would agree with @Marius Gunnerud . but just an HeadsUP! with ASA , if you use that feature on ASA it eats all memory/processing i tried on 5510. 

[CiscoPurpleBelt]

Yes I would nee to test so I am not sure I can use it if that is the case.

[CiscoPurpleBelt]

Awesome thanks!