Null Routes on Cisco ASA

Null routes are a great way to limit traffic from troubling networks without increasing your firewall Access Control Lists (ACL), which in turn will increase both the total CPU usage of the firewall and the delay of all traffic through the firewall. While just adding a line or two to the INBOUND/OUTBOUND ACL will not have much impact. When people are looking at blocking hundreds of potential problem networks, the null route is a much better solution.

First off this is an approximation to a Null route, due to the fact that the ASA has to have a defined interface for all its routes.

So we will be using the outside interface, but just using localhost IP (127.0.0.1) as the gateway address.

For this example I will be using a real hacker attacking my inside Linux server. I see I have 19 failed ssh attacks from the following IP: 193.104.41.53

Aug 16 21:12:35 li281-141 sshd[5775]: Invalid user admin from 193.104.41.53

Aug 16 21:41:24 li281-141 sshd[6138]: Failed password for invalid user pi from 193.104.41.53 port 22059 ssh2

Aug 16 22:24:18 li281-141 sshd[6641]: Failed password for root from 193.104.41.53 port 18919 ssh2

So now I found I bad guy, and I also know they are just pecking around, because they keep changing the username they are trying to attack.

So I could add a special firewall rule, but I get ten of these a week, so I have thousands. So the next step is to see where the hacker is coming from. For this I use one of the public whois servers.

https://www.ip-address.org/tracer/ip-whois.php

By doing a lookup I find out the hacker is from Moldova, I also find out there is a whole /24 network that they might attack me from.

Whois Information:

        Results for 193.104.41.53 :

So now I have a block of addresses and I know it is in a country that is attacking me, but I have no legitimate business with. This is a prime example of a network we would want to null route.

On the Cisco ASA I would use the command:

route outside 193.104.41.0 255.255.255.0 127.0.0.1

After adding this on my firewall I no longer see any scans or traffic authentication failures on the server.

Jason Howe, PEI