IP Blocking on FMC/FTD

[kostasthedelegate]

Hello, 

I would like to block some public IP addresses in the FMC in a manual way. 

When I see it in the events I have the option to select to blacklist it.

When I go to that blacklist I cannot add manually. 

Which is the best way to block a public IP?

Regards,

Konstantinos

[Rob Ingram]

Hi @kostasthedelegate 

You could create a manual list, define the IP addresses you wish to block and reference that list in the ACP as a blacklist. You'd need to manually download the list and re-upload to modify.

HTH

[kostasthedelegate]

Hello @Rob Ingram 

In the access policy you mean the URL tab?

Would it be better to use DNS policy?

What is the order the traffic flows in the FTD in order to cut the desired traffic as soon as possible?

[Rob Ingram]

No under the SI tab of the ACP, select the list and add to the blacklist. Screenshot below shows which is blocked first.

[kostasthedelegate]

Thank you Rob

I will test it!!

[kostasthedelegate]

Hello 

We tested it and we get that 0 IP found

Could you point me to the syntax of the file the list should contain?

Regards, 

Konstantinos

[Rob Ingram]

The list just needs to contain the IP address(es) you wish to block.

[kostasthedelegate]

I tried putting the IP only and it said It found 0 IPs

[Rob Ingram]