Block All traffic?? 1

[bristolxyz]

Suppose I'm reieving lots of spam from offshore spammers, not a ton, but just enough of the junk that I want to stop it from even getting to the mail server. Based on the originating IP, will an entry in a Cisco 3600 (ACL) stop it before entry into the mailserver. The IP has no reason to send traffic thru , other than to spam our email addresses....
Using SME Mail server

 

[tschouten]

My suggestion would be to use another device for spamm filtering. Why have your core router do this task? Try something like Eprism. Or look up other boxes like it that are free.

 

[bristolxyz]

I took a look at Eprisim, it look sgood for the job. We are looking into a Cisco PIX firewall for January. It's just that I thought it would be effective to be able to block the whole problem before it even hits the mail server. Our 3640 is not a very "busy" box and has a minimal load on the CPU. I'm just so sick and tired of the scumbag spammers. Someone's gonn come up with a global solution and that will be the end of it.
It's pathetic, when configuring a new computer, I spend more than an hour tweaking spam tunnels like messagner, etc.

 

[tschouten]

Unfortuantely, the second someone comes up with a global solution. Another more resourceful fellow will come up with the anti-global solution.

 

[tbilan]

Yes, you can write an ACL to stop IP packets originating from that source network from going to port 25 of your mail server.

access-list 150 deny ip 2.2.2.0 0.0.0.255 host 192.168.52.3 eq smtp
access-list 150 permit ip any any

int s0/0
access-group 150 in


Tom Bilan
TJBA, Inc.
CCNP, CCDP, MCSE & CNE