Add src ip to blacklist when trigger intrusion rule

[Ben Chen]

Hello,

I'm using firepower 4110 of now and is it possible when some host trigger intrusion rule then system auto add that ip into blacklist for a while?

If can, kindly tell me how to do that ,thank you.

Regards,

Ben

[yogdhanu]

Hi

You can do that using ISE host remediation.

You would need to integrate FMC to ISE which would quarantine the host with dacl on switch using policies configured on FMC.

Hope it helps,

Yogesh