Although one way to do it is with programmatically updating an ACL, you might consider
This latter technique is written up here, and can be somewhat complex:
It might be possible to do this with something much simpler such as RIP2 with next-hop filled in.
For the use you've indicated, it doesn't sound like you need it to be terribly fast, so I'd start with make-text-file-and-remotely-load it. The technique is extremely general and rather easy to do.
Run a script to create your ACL commands, probably periodically with cron or similar; then it issues
ssh edgerouter1 copy http://localserver/dynamicacl runing-config
Note that this "copy" is really a merge, in that it keeps the existing configuration except where the new config explicitely negates something with
no access-list 22 or similar.
You need certificate-based login on the router for this to be practical.
[EDIT] While trying it I found a small surprise so added details. I tested with Cisco 2800 router with 15.1.4 as I have no ASA available, server was Ubuntu 16.
To repeat, this is a pretty general way of doing any programmatic configuration of Cisco devices. In general it's much better to have a fully non-interactive approach, rather than an expect-based approach. If the interactive system does something unusual your expect script can go wrong in very difficult-to-debug ways. If this programmed-copy goes wrong you issue the identical command by hand and debug from there.
Example network For example clarity, suppose your ASA/router inside address is 192.168.0.1 and you have an internal web server available at 192.168.0.32.
Generate config It's supposed you have a program
badaddresses which produces a list of addresses you want to block. Make a formatter
mkciscoacl in awk/python/whatever to produce your appropriate access list, which might look like this:
ip access-list extended autobad
1 deny ip host 10.10.0.5 any
2 deny ip host 10.10.0.9 any
1000000 permit ip any any
Put on internal web Let's imagine you have a cron job which makes that file on the web server, available as http://192.168.0.32/cisco/automatic.conf
No-prompt Normally, when you do
copy http://somewhere running-config you get a prompt confirming the target as
running-config. This must be disabled in your configuration.
file prompt quiet
Certificate login You must have a certificate-based login available on your router, as you want the configuration to be entirely automatic. (Doc)
username autoloader priv 15 secret 12345 ! use a better one!
ip ssh pubkey-chain
Do whole thing Make a script
dowholething.sh which does the whole thing
badaddresses | mkciscoacl > /var/www/html/cisco/automatic.conf
ssh [email protected] \
copy http://192.168.0.32/cisco/automatic.conf running-config
Automatic invocation On the web server, have a cron job like this:
* * * * * /path/to/dowholething.sh
Obviously you could do any configuration you like with this method. You might also consider source-based routing into a blackhole rather than straight blocking.