I've got a script set up (triggered by Fail2Ban) to block hosts at the edge of our network. It adds the IP address to a group that's already blocked by an ACL, and then clears the connection out.
configure terminal object network 18.104.22.168 host 22.214.171.124 description Fail2ban exit object-group network bad_nets network-object object 126.96.36.199 end clear conn address 188.8.131.52 netmask 255.255.255.255 ! 5 second delay clear conn address 184.108.40.206 netmask 255.255.255.255
We go through and clean them out after a few months to avoid having too many hosts, and it works well for us. I recently had a host that I was unable to block immediately though. I logged in to the ASA and attempted to run the
clear conn command myself. Every time I ran it, I got the response:
1 connection(s) deleted.
I ran a
packet-tracer command which returned this:
Phase: 1 Type: FLOW-LOOKUP Subtype: Result: ALLOW Config: Additional Information: Found flow with id 2195365741, using existing flow
So, my question: how do I immediately and unconditionally block a host that has established connections across the firewall? Is there a way to remove any "flows" associated with a host?
Cisco Adaptive Security Appliance Software Version 9.4(3)4