Firepower services to block IP adddress

[dan hale]

Hello, is there a mechanism in the new Firepower that can block IP address originating from different countries? I have a site that gets bombarded by DOS and Dictionary attacks. I have called the ISP in the past but, that can be difficult in getting the ISP to corporate.

Thanks,

Dan

[nspasov]

Hi Dan-

Yes, you can create a rule based on "Geolocation" in FireSIGHT. In your Access Control Policy create a new rule > Go to the "Networks" tab > click on the "Geolocation" sub-tab. From there you can pick a specific country or a whole region.

I hope this helps!

Thank you for rating helpful posts!