Good day Dear colleagues,
I'm trying to setup some highly automatic VCS environment when one component piece will analyze VCS logs and another component piece will find some matches in VCS logs then based on the matches add & enable some new firewall rules in the built in VCS firewall. The purpose for this kind of automation is to automatically detect & stop pesky SIP spam and toll fraud calls. I have very good stop & deny call policy rules in place but I don't want these calls to even get to my VCS or if they get I don't want my VCS to process them at all. I have these rules setup & working for more than two years now and they've proved to be very efficient but the next and a natural step, I think, is to stop these calls at the networking layer. Let's say, VCS sees suspicious calls coming from some IP address and my script will automatically add a corresponding firewall rule to block this IP address for some predefined period of time.
There are three assumptions which I know I have to take into consideration:
1. Bad boys can spoof an IP address and cause me to block some valid IP but at this moment I can live with this assumption,
2. I want to use built in VCS firewall, don't want to touch my corporate firewall,
3. I'll have to "review & clean" my VCS firewall rules from time to time.
P.S. of course if Cisco R&D will implement some better control over the VCS built in firewall functionality then this discussion can or will take another route but right now I'm looking for some API commands that will allow me to manupulate with VCS firewall rules from CLI interface or any other scripting environment.
Thanks a lot!
