I was wondering if there is any Cisco product that supports import of external list with IP ranges to be blocked or allowed.

CIRD format:

# List distributed by ...

123.15.49.0/24
60.166.28.0/24
114.36.130.0/24
195.56.150.0/24
212.117.177.0/24
89.242.30.0/24
87.106.3.0/24
61.235.46.0/24
210.112.12.0/24

The updates would be daily.

link|improve this question

feedback

2 Answers

up vote 2 down vote accepted

In what form would this list be supplied, and how often would you want to update it? You could set up a cron job that copies over an access-list on a daily basis, or you could set up a BGP peer with a quagga server to feed it a list of routes, but you're not likely to find a button that says 'block these IPs'.

link|improve this answer
You would have to write this yourself - in a general sense, put the file into a location on a server, run some perl or whatever to change it into access-list format, then use a cron job to copy that list to the router on a daily basis. Oh, and remember to be sure to error-check that list before you copy it, you wouldn't want to accidentally put a 0.0.0.0/0 block in, would you? – Aaron Dec 1 '11 at 19:54
updating the acl commands is easy - int X/Y, no access-list 101 in, no access-list 101, copy rcp://1.2.3.4/newacl.txt running-config, int x/y, access-list 101 in – Aaron Dec 1 '11 at 20:01
feedback

Based on on @Aaron's answered this is what I came up with:

conf t
int f0/0
no ip access-group 101 in
exit
no access-list 101
exit
copy ftp://192.168.1.100/access-list-101.txt running-config 
running-config
conf t
int f0/0
ip access-group 101 in
exit 
exit
conf t 
service compress-config 
exit
wri mem 

And here is how you can use kron:

http://www.cisco.com/en/US/docs/ios/12_3/feature/guide/g_kron.html

And here is little java hint on how do the conversion:

http://stackoverflow.com/q/8347908/465179

link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.