Block vs. no reply - range of external IP's

[alceryes3]

5505 - 9.02

I would like to disallow a range of IP's from getting through my firewall and attempting to authenticate. I've got the basic command -

access-list outside_in deny ip X.X.X.X 255.255.255.224 any

But does this command cause my ASA to respond with 'denied' or does it just ignore the traffic? I would rather it just ignore. Also, can the IP range be entered as a slash instead of subnet (i.e. /24 instead of 255.255.255.0)?

[Richard Atkin · Accepted solution]

It just drops the traffic silently.

You can also prove this for yourself by downloading Nmap and getting it to port scan the IP(s) you're trying to protect.

Sent from Cisco Technical Support iPhone App

[alceryes3]

Thanks!

Do you know if you can enter CIDR's for ACL's with a slash instead of listing the whole subnet?