If I have a single IP that's trying a Denial of Service attack, how can I automatically have it banned/shunned? I go in and manually put it in a group of banned IP addresses, but I'd like for it to be done automatically, maybe if someone has 30 simultaneous connections. Cisco ASA.

  • Perhaps use modsecurity (an open source WAF) – sandyp Jun 30 '16 at 22:19
  • 1
    If you use Linux as the server you want to protect, check fail2ban. That is in case you can't achieve it at your firewall (Cisco ASA) level. – lepe Jul 1 '16 at 1:47
  • fail2ban would not prevent from a DDoS scenario. It is primarily designed for limiting sequential attempts. – sandyp Jul 1 '16 at 17:03
  • Do you need a sequence of CISCO IOS commands for an actual router, or are you doing something on a PC? If PC which operating system. – cybernard Jul 7 '16 at 1:18
  • 2
    @sandyp a single IP does not a DDoS make – schroeder Sep 5 '16 at 8:58

I believe this would be possible using the ASAs threat-detection commands. For example using threat-detection you could setup scanning-threat and then use the shun command.

To further add to this - one implementation would be to create an object on the ASA that acts as a whitelist and then using threat-detection scanning-threat shun exception insert whitelist group object name you would be able to shun anything that is NOT in that whitelist. Please be aware that is not the exact syntax you will have to use the docs & ? to find the exact commands however its mostly the correct syntax.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.