How to block foreign countries?

kope · ‎07-17-2008

Is there a simple way to block ip addresses by foreign countries? There is so many network addresses needs to be blocked, it seems it is not practical on the ASA. Can someone give me some suggestions on this?

JORGE RODRIGUEZ · ‎07-17-2008

You would need to gather info on Public IP block assigments by country, based on gather IP block assigments you can block the entrirely ip blocks at an edge router outside your firewall, you can create a deny acl, summarize ip blocks assigememst using wildcard mask and apply it to your inbound interface.

Database search for IP blocks by countries

http://www.countryipblocks.net/

Info on IANA, global coordination of IP global addressing.

http://www.iana.com/

Follow similar example on bellow link acls but use unwanted public IP blocks in acls.

Filtering at the edge

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801afc76.shtml

Rgds

Jorge

Jorge Rodriguez