Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a cisco pix 515 as firewall for some web servers. What I want to do is to automatically add banned ips to the firewall to block traffic at the network level.

At the present time I have a software hooked on the web server software, monitoring repeated failed logins, floods or any suspicious activities. The missing piece is a way to block the traffic when an ip is banned.

I think the best solution would be to dynamically add the ip to an ACL on the PIX in front of the web server.

Is it possible to do that via SNMP or via any other means? The web servers are all running UNIX.


share|improve this question
up vote 1 down vote accepted

if you know the ip that you want to block you can use an 'expect' script to add a 'shun ' command or the comparable acl

you can get a feel for this by looking at the following thread :

share|improve this answer
The hack detection takes place at the application level, then the application should be able to blacklist the IP on the firewall. – user23758 Dec 23 '09 at 0:23
I did it with expect and shun, works fine. – user23758 Dec 24 '09 at 11:19

I'm not aware of a way to do this manually on the pix. If you can upgrade your PIX to an ASA, you could get the IPS module in your ASA which will issue the SHUN command automatically for IPs that are trying to hack.

share|improve this answer
I've never done this, but it should be doable over SNMP, or possibly with expect, or some more code. – Cian Dec 22 '09 at 23:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.