I created an access list with one spot at line 30 that I reserved to put
some IP address that I want all traffic blocked. So, in the case of an
attack, even though I know the hosts will have intrusion detection,
there are times where I still want to block that IP, if only to save log
file space from all their attempts to log into "Administrator".

ip access-list extended ACLinbound
        permit tcp any any established
        permit tcp any 10.0.0.0 0.0.255.255 eq 80
        deny ip host 72.0.206.240 any
        ...

However, to do this during an attack, I found I need to do the following:

configure terminal
ip access-line extrended ACLinbound
no 30
30 deny ip host <new ip address> any
end

Is there a better way to quickly tell a router to block any/all traffic
 ? usually, those blocks are needed just for a few minutes until the
hacker moves on to a different IP address.

I've found that when I block an IP while he is attempting to login many
times, the pubescent hacker just moves on to some other target and all
is quiet for a long time until some other hackers starts to test my IP.

Since I have no need, nor intention to record those IPs or grow a list
to include every attack I've ever had, my goal is to re-use an existing
access-list entry.

Is it more efficient to re-use an entry in a multi-entry access list
which contains all rules for that interface, or is it more efficient to
have 2 separate access lists (with second one containing only that
sporadic entry) attached to the interface ?

As long as the attacker uses a dynamic ip address, you have to block
each new one.

What I would do if I were you is create a new ACL
router(config-if)# ip access-group 101 in

geoa... at (no spam) gmail.com wrote:
So, are you trying to say that you have to let him login and then take
some action?

No. Sometines a console constantly rings, and I see someone trying a
password dictionary attack on a system. So I check which IP this attack
is coming from and program the router to stop him. The system has
already blocked that user through intrusion detection, so blocking the
IP at the router is more of a "conveniemnce" which stops the constant
flow of alarms and gets the attacker to move on to attack someone else.

So, are you trying to say that you have to let him login and then take
some action?

On 23 ???, 10:28, JF Mezei <jfmezei.spam... at (no spam) vaxination.ca> wrote:

Since I have no need, nor intention to record those IPs or grow a list
to include every attack I've ever had, my goal is to re-use an existing
access-list entry.

Attacks shouldn't exist on a daily basis. If you have to deal with
this kind of attacks all the time, you have a critical security
issue.

Meanwhile, at the comp.dcom.sys.cisco Job Justification Hearings,
geoa... at (no spam) gmail.com chose the tried and tested strategy of:

On 23 ???, 10:28, JF Mezei <jfmezei.spam... at (no spam) vaxination.ca> wrote:
Since I have no need, nor intention to record those IPs or grow a list
to include every attack I've ever had, my goal is to re-use an existing
access-list entry.

Attacks shouldn't exist on a daily basis. If you have to deal with
this kind of attacks all the time, you have a critical security
issue.

Presumably you have nothing connected to the internet then.

--
 <http://ale.cx/> (AIM:troffasky) (UnSoEsNpE... at (no spam) ale.cx)
 16:16:14 up 7 days, 10:55,  4 users,  load average: 0.26, 0.20, 0.18
 "Stupid is a condition. Ignorance is a choice" -- Wiley Miller

Meanwhile, at the comp.dcom.sys.cisco Job Justification Hearings,
geoa... at (no spam) gmail.com chose the tried and tested strategy of:

So, you're saying brute-force and dictionary attacks on a daily basis
is normal on a single network?

What is 'normal'? What is a single network? For yesterday:

# grep "Invalid user" /var/log/auth.log.0  | awk '{ print $10 }' | sort | uniq -
c | sort -rn | head
   4474 82.143.224.114
    128 200.78.235.21
      4 78.43.153.131
      4 194.76.253.121
      3 91.187.45.168
      3 85.222.104.77
      3 82.160.33.7
      3 81.199.47.9
      3 217.194.133.206
      3 213.246.205.150

This pattern is repeated with different services on different servers, all over
the internet. So I would say that whilst attacks shouldn't exist on a daily
basis, they do. It's just part of the normal background noise of the internet.

--
 <http://ale.cx/> (AIM:troffasky) (UnSoEsNpE... at (no spam) ale.cx)
 09:49:16 up 8 days,  4:43,  4 users,  load average: 0.38, 0.39, 0.27
 "Stupid is a condition. Ignorance is a choice" -- Wiley Miller

Meanwhile, at the comp.dcom.sys.cisco Job Justification Hearings,

Presumably you have nothing connected to the internet then.

So, you're saying brute-force and dictionary attacks on a daily basis
is normal on a single network?