Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a cisco pix 515 as firewall for some web servers. What I want to do is to automatically add banned ips to the firewall to block traffic at the network level.

At the present time I have a software hooked on the web server software, monitoring repeated failed logins, floods or any suspicious activities. The missing piece is a way to block the traffic when an ip is banned.

I think the best solution would be to dynamically add the ip to an ACL on the PIX in front of the web server.

Is it possible to do that via SNMP or via any other means? The web servers are all running UNIX.

Thanks.

share|improve this question
add comment

2 Answers 2

up vote 1 down vote accepted

if you know the ip that you want to block you can use an 'expect' script to add a 'shun ' command or the comparable acl

you can get a feel for this by looking at the following thread :

http://www.mail-archive.com/ossec-list@googlegroups.com/msg01942.html

share|improve this answer
    
The hack detection takes place at the application level, then the application should be able to blacklist the IP on the firewall. –  user23758 Dec 23 '09 at 0:23
    
I did it with expect and shun, works fine. –  user23758 Dec 24 '09 at 11:19
add comment

I'm not aware of a way to do this manually on the pix. If you can upgrade your PIX to an ASA, you could get the IPS module in your ASA which will issue the SHUN command automatically for IPs that are trying to hack.

share|improve this answer
    
I've never done this, but it should be doable over SNMP, or possibly with expect, or some more code. –  Cian Dec 22 '09 at 23:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.