Considering a Cisco ASA (5500-X) firewall for our internet edge in front of our web cluster.
At the moment, we use a Linux box with iptables. A log analysis system detects brute-force attacks on WordPress blogs, forum spam, hacking attempts, and much more. Illicit activity will result in a short-lived block of the offending IP address.
The list of blocked IPs, however, is around 30,000 IPv4 addresses. Can we load these into a Cisco 5500-X using an API or similar, and how many IP addresses / rules can it handle?
We currently use ipset (a hashtable) to deal with the large number of IP blocks.