Block malicious domains at interface level

[Vijaygvasan]

Hi Team,

I have a concern where is there any way to block malicious domain based or malicious ip based traffic ingress through the firewall to trust zone or dmz zone from untrust zone to be blocked at interface level even before it reaches to pbf or policy or processing over firewall.

Is there any way to block malicious domain before it is being processed. Let me know the possibilities.

[BPry]

@Vijaygvasan,

If you don't want this traffic to be processed by the firewall, you would need to drop it before it reaches your firewall. If you have that requirement then that traffic should be dropped immediately by your first controlled network resource, so in most cases a router. 

[Vijaygvasan]

So firewall cannot drop a packet at isp interface level am i right?