Cisco Systems IPS4510K9 Obtaining a List of Blocked Hosts and Connections, Blocking a Connection

Chapter 14 Configuring Attack Response Controller for Blocking and Rate Limiting

Obtaining a List of Blocked Hosts and Connections

Blocking a Connection

To block a connection, follow these steps:

Step 1 Log in to the CLI using an account with administrator or operator privileges.

Step 2 Configure the connection block between a source IP address and a destination IP address specifying the port, protocol, and time, for example. The connection block ends in 30 minutes.

sensor# block connection 10.0.0.0 172.16.0.0 port 80 protocol tcp timeout 30

Step 3 Start a connection block. The connection block lasts until you remove it.

sensor# block connection 10.0.0.0 172.16.0.0

Step 4 End the connection block.

sensor# no block connection 10.0.0.0

sensor#

Obtaining a List of Blocked Hosts and Connections

Use the show statistics command to obtain a list of blocked hosts and blocked connections. To obtain a list of blocked hosts and connections, follow these steps:

Step 1	Log in to the CLI.
Step 2	Check the statistics for the ARC. The Host entry indicates which hosts are being blocked and how long
	the blocks are.
	sensor# show statistics network-access
	Current Configuration
	LogAllBlockEventsAndSensors = true
	EnableNvramWrite = false
	EnableAclLogging = false
	AllowSensorBlock = false
	BlockMaxEntries = 250
	MaxDeviceInterfaces = 250
	NetDevice
	Type = Cisco
	IP = 10.1.1.1
	NATAddr = 0.0.0.0
	Communications = telnet
	BlockInterface
	InterfaceName = fa0/0
	InterfaceDirection = in
	State
	BlockEnable = true
	NetDevice
	IP = 10.1.1.1
	AclSupport = uses Named ACLs
	Version = 12.2
	State = Active
	BlockedAddr
	Host
	IP = 192.168.1.1
	Vlan =
	ActualIp =
	Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01		14-33