Blocking lists of transparent proxies etc

george_daly · ‎09-26-2007

Hi,

I'd be very interested how others deal with blocking lists of known bad guys, transparent proxies etc. I know there are IP lists that can be obtained from various places, one that I recently saw has over 500k entries..

That's obviously not suitable for an edge ACL or null routing.

How do others deal with blocking very large lists of IPs, or do you just not do this?

I'd be particularly interested in solutions involving F5 BigIPs, FWSM or ASA.

Cheers,

George

srue · ‎09-26-2007

I used IPS devices inline to block all addresses from China. IPS units are already examining every packet. I didn't want the routers to do it because they were already running full BGP routing tables. That would have been too much overhead for the PIX515e's in place at this particular location.

There weren't even close to 500k entries though.