So I have a list of malicious IPv4 addresses (botnet/scanning traffic) that I would like to feed into my ASA automatically in order to blacklist. The list is very long (1M+ entries) and is being dynamically updated. Is there a good way to do this? Or is there perhaps a separate tool that could do this? The list is simply a text file with one address per line. I have thought about possibly doing this with a script via the "shun" command, but this seems messy and I don't know how well the ASA will support having over a million shun entries. The ASA is a 5545X running 9.7(1).
Also, for those that may be wondering, this is a special case where we cannot outright block all traffic on a particular port to prevent this scanning, but rather have to identify the bad actors and blacklist them individually. The ASA has threat-detection turned on which we have looked at, as well as firepower. Neither one of these were able to meet our needs in this case.
Any help would be greatly appreciated!
