1

I have been collecting different IP address for VoIP attacks in my infrastructure. These attacks happen every day multiple times. I have created a service which generates a notification to a python subscriber service which can then execute any action upon request.

Is it possible to add an ACL for each IP address that appears programmatically?. Example via a REST API to ASA. This is the JSON object I generate, I will just need to configure my python script to use the IP address and send a request to ASA to update ACL, in case IP address already there ignore.

{u'Content': u'163.172.120.42', u'From': u'honeypot-ef4b6aa1-d5ca-43f8-92c8-f9840fb5bb9f-deadbeef'}
1
  • I think you'll have to do it from the CLI, with an Expect script (or similar).
    – Ron Trunk
    Feb 12 '18 at 13:59
5

Although one way to do it is with programmatically updating an ACL, you might consider

This latter technique is written up here, and can be somewhat complex: https://www.cisco.com/c/dam/en/us/products/collateral/security/ios-network-foundation-protection-nfp/prod_white_paper0900aecd80313fac.pdf

It might be possible to do this with something much simpler such as RIP2 with next-hop filled in.

For the use you've indicated, it doesn't sound like you need it to be terribly fast, so I'd start with make-text-file-and-remotely-load it. The technique is extremely general and rather easy to do.

Run a script to create your ACL commands, probably periodically with cron or similar; then it issues

ssh edgerouter1 copy http://localserver/dynamicacl runing-config

Note that this "copy" is really a merge, in that it keeps the existing configuration except where the new config explicitely negates something with no access-list 22 or similar.

You need certificate-based login on the router for this to be practical.

[EDIT] While trying it I found a small surprise so added details. I tested with Cisco 2800 router with 15.1.4 as I have no ASA available, server was Ubuntu 16.

To repeat, this is a pretty general way of doing any programmatic configuration of Cisco devices. In general it's much better to have a fully non-interactive approach, rather than an expect-based approach. If the interactive system does something unusual your expect script can go wrong in very difficult-to-debug ways. If this programmed-copy goes wrong you issue the identical command by hand and debug from there.

Example network For example clarity, suppose your ASA/router inside address is 192.168.0.1 and you have an internal web server available at 192.168.0.32.

Generate config It's supposed you have a program badaddresses which produces a list of addresses you want to block. Make a formatter mkciscoacl in awk/python/whatever to produce your appropriate access list, which might look like this:

ip access-list extended autobad
 1 deny ip host 10.10.0.5 any
 2 deny ip host 10.10.0.9 any
 1000000 permit ip any any
end

Put on internal web Let's imagine you have a cron job which makes that file on the web server, available as http://192.168.0.32/cisco/automatic.conf

No-prompt Normally, when you do copy http://somewhere running-config you get a prompt confirming the target as running-config. This must be disabled in your configuration.

file prompt quiet

Certificate login You must have a certificate-based login available on your router, as you want the configuration to be entirely automatic. (Doc)

username autoloader priv 15 secret 12345 ! use a better one!
ip ssh pubkey-chain
  username autoloader
    key-string
      ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDZahXX11Muz3ChJtmVvofZhv5T
        ...
        username@webserver
    exit
  exit
exit

Do whole thing Make a script dowholething.sh which does the whole thing

#!/bin/sh
set -e
badaddresses | mkciscoacl > /var/www/html/cisco/automatic.conf
logger blahblah
ssh autoloader@192.168.0.1 \
  copy http://192.168.0.32/cisco/automatic.conf running-config

Automatic invocation On the web server, have a cron job like this:

* * * * * /path/to/dowholething.sh

Obviously you could do any configuration you like with this method. You might also consider source-based routing into a blackhole rather than straight blocking.

1
  • Thank you jonathanjo, by setting up 1 honeypot in AWS I have seen around 100 requests from different IP addresses and this is just 1 I plan to deploy ~20 in different datacenters and other cloud services... wondering if I can define in ASA a unique ACL which will grow eventually when I add these IP address programmatically ? (Example: using expect).
    – gogasca
    Feb 12 '18 at 22:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.