Block an IP on the net

[adrian.h]

I want to drop packets from a MyDoom infected IP on the net that is hammering our mail server. How can I go about doing this on a PIX w/ 6.1?

Thanks

[tvanginneken]

Hi,

since that IP on the Net is infected, I would not trust any kind of traffic coming from that IP. If you already have an access-list (ACL) on your outside interface, then add just this line (make sure you put this entry above the entry that allows the 'MyDoom' traffic to your mail server):

access-list deny ip any

Kind Regards,

Tom

[patrick.cannon]

null route the smtp.

I had this problem and a spare nic in the pix. I routed the subnets that I disliked there. Problem resolved. It isn't particularly elegant but it particularly worked...

[ali-franks]

As Tom mentioned, ACL's are one option , but the other is use:

shun x.x.x.x

HTH

Ali

[adrian.h]

Yeah, I should have noted its a 506 though :)

I will try this shun command. Thanks.