Auto ACL blocker

[tmagill at providecommerce.com (Thomas Magill)]

I would consider doing it through BGP via quagga or such.  Nullrouting with BGP is much cleaner than ACLs as your config stays static and only your routing table changes.  I also imagine due to existing BGP blacklisting methods, that much of the work is already done and all you need is to get the honeypot to export the right format.

-----Original Message-----
From: Brian R. Watters [mailto:brwatters at absfoc.com] 
Sent: Tuesday, January 18, 2011 11:12 AM
To: nanog at nanog.org
Subject: Auto ACL blocker

We are looking for the following solution. 

Honey pot that collects attacks against SSH/FTP and so on 

Said attacks are then sent to a master ACL on a edge Cisco router to block all traffic from these offenders .. 

Of course we would require a master whitelist as well as to not be blocked from our own networks. 

Any current solutions or ideas ?? 

-- 

BRW