Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

To be more specific I have a request from a client to block China's IP range. I know how to do this. I would use the IPs from and make a ACL. Well if you take a look at that there are 3,412 networks I would have to block.

What I'm really asking is there a way around making a super large ACL? If it was contiguous IP space I could just supernet but that is not the case.

share|improve this question
You could do a block on a router by AS Number (smaller list of stuff to block), but not sure about doing it on a firewall... – voretaq7 Jun 16 '11 at 18:41
up vote 2 down vote accepted

If a gigantic network object group is more to your liking than a gigantic ACL, then I guess that'd be the other option. It's the same level of ugly in the command line and in execution, but it'd make it prettier in ASDM, I suppose.

Be very careful of blanket blocks of countries; I've seen it cause some interesting issues. ("Why can't I get to Windows Update?" "Oh, you're hitting an Indonesian server, and someone blocked all of Asia")

share|improve this answer
yeah if it would happen it would have been added as big ol' network object. – evolvd Jun 16 '11 at 22:47
Guess there isn't another way to do this. Thanks for the input! – evolvd Jun 17 '11 at 12:05

At Country IP Blocks we can aggregate contiguous networks to make the output significantly smaller. Just contact us and ask.

share|improve this answer
Hey, Yeah that is where I got the large list from originally. I don't have a need for this any more but I'm sure it will come up again at some point. Instead of having to contact you to get the aggregated list would this become something that is offered directly from the site? – evolvd Dec 25 '11 at 15:49

I've created a script where all you have to do is choose an authority and it'll give you the configuration to drop into the ASA. It's incredibly accurate.


You can block or allow a specific region if you want. I'll be updating it soon to do specific countries but now it does authorities like ARIN, RIPE, APNIC, etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.