topic Re: Block traceroute in General Topics

Block traceroute

s_quasar — Tue, 12 Nov 2019 16:35:23 GMT

Hi all,

is there a way to block IP source if I match traceroute App-ID? Maybe with a custom vulnerability?

Re: Block traceroute

S.Cantwell — Wed, 13 Nov 2019 06:18:38 GMT

Hello

I am not sure I completely understand the question.

Can you block a source IP using traceroute app-id?

you can create a policy to deny traceroute from a source IP, yes.

is that your question?

Please advise.

Re: Block traceroute

s_quasar — Wed, 13 Nov 2019 17:00:13 GMT

Hi,

no, I want to block IP not deny like in reconnaissance in zone protection or in vulnerability protection that you can create a custom rule with 3600 seconds block IP.

Re: Block traceroute

S.Cantwell — Wed, 13 Nov 2019 17:56:02 GMT

I appreciate the response.

Maybe I do not understand; deny and block provide similar functionality

My original response of creating a rule to drop/deny a Source Address is probably the best way to block the IP.

I am not being argumentative, perhaps explaining more additional details regarding the use case for this request, will be help everyone to provide better responses.

Re: Block traceroute

OtakarKlier — Wed, 13 Nov 2019 23:09:01 GMT

Hello,

I do not think that is possible. However you can just have a policy that explicitly denies the application.

Regards,

Re: Block traceroute

pteixeira — Wed, 13 Nov 2019 23:16:07 GMT

Ill toss in that configuring ICMP error in Zone Protection can help limit the use of Trace-route.

Re: Block traceroute

s_quasar — Thu, 14 Nov 2019 15:30:51 GMT

I want to consider that if an IP make traceroute, this is the first step to do other bad activities on my infrastructure so I want to block it (and not deny) before it can attempt to infiltrate in my network.

Re: Block traceroute

OtakarKlier — Thu, 14 Nov 2019 15:42:09 GMT

Hello,

While I agree this could be a start to bad things, its a common tool used by many different engineers. I high caution you against a block-ip approach as this will block legit traffic to/from a good host because someone ran a command.

Just a deny rule is much better in this case.

Regards,