I have a cisco pix 515 as firewall for some web servers. What I want to do is to automatically add banned ips to the firewall to block traffic at the network level.
At the present time I have a software hooked on the web server software, monitoring repeated failed logins, floods or any suspicious activities. The missing piece is a way to block the traffic when an ip is banned.
I think the best solution would be to dynamically add the ip to an ACL on the PIX in front of the web server.
Is it possible to do that via SNMP or via any other means? The web servers are all running UNIX.