Cisco Secure Firewall (Firepower)

Add the list as a Security Intelligence feed and block it in your access control policy.

Cisco Secure Firewall (Firepower Threat Defense, managed by the Management Center) blocks known bad addresses early with Security Intelligence, before the traffic reaches access control rules. Add the blocklist as a custom feed.

Set it up

In the Management Center, go to Objects › Object Management › Security Intelligence › Network Lists and Feeds and click Add Network Lists and Feeds.
Set Name to isipsafe, Type to Feed, Feed URL to:
```
https://isipsafe.com/api/v1/blocklist?key=sl_your_key_here&format=txt&confidenceMinimum=90
```
and Update Frequency to 1 hour. Leave the MD5 URL empty. Save.
Open your Access Control Policy, go to the Security Intelligence tab, select the isipsafe feed under Networks and click Add to Block List. Enable logging if you want to see the hits.
Deploy the policy. Blocked connections appear under Analysis › Connections › Security Intelligence Events.

The Management Center downloads the feed and pushes it to the managed devices, so only it needs to reach isipsafe.com. To try it without blocking, set the feed to Monitor-only in the Security Intelligence tab first.

Need a hand?

If something here does not work with your version of Cisco Secure Firewall (Firepower), or you have improved it, tell us. We update these pages with what people send.

Cisco Secure Firewall (Firepower) and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.