4

I've got a script set up (triggered by Fail2Ban) to block hosts at the edge of our network. It adds the IP address to a group that's already blocked by an ACL, and then clears the connection out.

configure terminal
object network 1.2.3.4
host 1.2.3.4
description Fail2ban
exit
object-group network bad_nets
network-object object 1.2.3.4
end
clear conn address 1.2.3.4 netmask 255.255.255.255
! 5 second delay
clear conn address 1.2.3.4 netmask 255.255.255.255

We go through and clean them out after a few months to avoid having too many hosts, and it works well for us. I recently had a host that I was unable to block immediately though. I logged in to the ASA and attempted to run the clear conn command myself. Every time I ran it, I got the response:

1 connection(s) deleted.

I ran a packet-tracer command which returned this:

Phase: 1
Type: FLOW-LOOKUP
Subtype: 
Result: ALLOW
Config:
Additional Information:
Found flow with id 2195365741, using existing flow

So, my question: how do I immediately and unconditionally block a host that has established connections across the firewall? Is there a way to remove any "flows" associated with a host?

Cisco Adaptive Security Appliance Software Version 9.4(3)4

4
  • 1
    Have you ever heard about "SHUN"? – lsad Feb 15 '18 at 8:01
  • have you tried "clear local-host x.x.x.x" to see if this removes the existing flow – A-A-Ron Feb 15 '18 at 18:21
  • @A-A-Ron I have not, I’ll check it out. – miken32 Feb 15 '18 at 20:40
  • @lsad I have but I thought it was more for automated blocking by the firewall. Will check it out. – miken32 Feb 15 '18 at 20:43
2

My recommendation would be to edit that script to "shun" that IP address, this way you do not have to worry since it would be blocked. In addition if the traffic was UDP the "clear local-host" command would not work since the UDP does not establish a connection.

Reference link for the shun command: https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/S/cmdref3/s15.html

1
  • Sorry for the delay, but yes this works. I'm using shun 1.2.3.4 followed by clear conn address 1.2.3.4 (just out of an abundance of caution) and then no shun 1.2.3.4. The clear conn command is consistently returning 0 now, indicating the shun command is immediately terminating all the traffic flows. – miken32 Nov 26 '19 at 19:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.