I manage an ASA 5520 with an ASA-SSM module at our university. The ASA-SSM-10 works well in detecting P2P traffic. When P2P is detected, the firewall is configured to deny the attacker Internet access for 1 hour. The "attacker" in our case would be the internal device initiating the P2P traffic. So, the IPS will put our internal users in the "denied atttacker" list. Which is the way we want it; to preserve our ISP bandwidth.
Frequently new users come onto campus with P2P applications running and wonder why they can't get on the Internet.
However, I would like to know a method of redirecting the denied "attacker" to a web page that alerts them to the fact they have been denied and offer solutions for them to gain Internet access on thier own rather than calling the helpdesk. I have not been able to find a solution in the documentation.
