14-32
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter14 Co nfiguring Attack Response Controller for Blocking and Rate Limiting
Configuring Connection Blocking
Use the block network ip-address/netmask [timeout minutes] command in privileged EXEC mode to
block a network. Use the no form of the command to remove a block on a n etwork. You must have
blocking configured before you can set up network blocks. You can also view a list of networks that are
being blocked. If you do not configure the amount of time for the network block, it is permanent.
The following options apply:
•
ip-address/netmask—Specifies the network subnet to be blocked in X.X.X.X/ nn format, where
X.X.X.X specifies the sensor IP address as a 32-bit address written as 4 octets separated by periods
where X = 0-255, and nn specifies the number of bits (1032) in the netmask.
•
minutes—(Optional) Specifies the duration of the network block in minutes. The valid range is 0 to
70560 minutes.
Blocking a Network
To block a network, follow these steps:
Step 1
Log in to the CLI using an account with administrator or operator privileges.
Step 2
Configure the network block for 15 minutes, for example. The network blo ck ends in 15 minutes.
sensor# block network 192.0.2.0/24 timeout 15
Step 3
Start a network block. The network block lasts until you remove it.
sensor# block network 192.0.2.0/24
Step 4
End the network block.
sensor# no block network 192.0.2.0/24
sensor#
Configuring Connection Blocking
Note
Connection blocks and network blocks are not supported on adaptive security appliances . Adaptive
security appliances only support host blocks with additional conne ction information.
Use the block connection source-ip-address destination-ip-address [port port-number] [protocol type]
[timeout minutes] command in privileged EXEC mode to block a connection between two IP addresses.
Use the no form of the command to remove the connection block. You must have blocking configured
before you can set up connection blocks. You can also view a list of connections that are being blocked.
If you do not configure the amount of time for the connection block, it is permanent.
The following options apply:
•
source-ip-address—Specifies the source IP address in a connection block.
•
destination-ip-address—Specifies the destination IP address in a connection block.
•
port-number—(Optional) Specifies the destination port number. The valid range is 0 to 65535.
•
type—(Optional) Specifies the protocol type. The valid types are tcp or udp.
•
minutes—(Optional) Specifies the duration of the connection block in minutes. The valid range is 0
to 70560 minutes.