cannot block infected host

[lcaruso]

Need some help.

I cannot block an internal host with an smtp virus with an ACL denying all ip from that host to any.

I assume this is because the connections are already established. I've tried clear local-host on that internal address but didn't help.

How do I stop a host with established connections?

[Jouni Forss · Accepted solution]

Hi,

The ACL should be enough to block any new connections from the host towards any other interface on the ASA.

If you want to clear up a specific hosts connections then you could use

clear conn address

Or you can clear the translations for that host

clear xlate local

But to be honest I think the "clear local-host" command should already accomplish the same as above.

Have you confirmed that the block rule that you created is getting hits?

- Jouni

[lcaruso]

I tried clear-local host ip address all but the volume of traffic was so high it didn't stop everything until I used clear conn.

Thanks.