Blocking p2p on router 877

Hi,
Can anyone suggest how can I effectively block p2p traffic like Ares, Limewire or other with Cisco IOS 12.4(6) or higher? I tried NBAR but I guess there is no PDLM available for Ares for instance.
Many thanks for any suggestions.
Remi

Hi,
to block p2p traffic you need to block all ports except these you really need.
For example block all ports except http, https, smtp, pop3, dns.
Becouse some of the p2p applications use port 80 to connect there is an options in firewall(classic or Zone-Based Policy Firewall) called protocol-violation and port-missue!
This options prevent non-HTTP traffic over port 80.
For Zone-Based Firewall reffer to this link:
http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00808bc994.shtml

Similar Messages

Howto block p2p traffic of clients connected to the same ssid on different wlc

Hi all,
I use two wlc 4400 (4.2.x version) with a mobility domain and one ssid, both wlc are connected to a cisco l2 switch infrastructure. On the wlc I use the p2p blocking action 'drop' (http://www.cisco.com/en/US/docs/wireless/controller/5.2/configuration/guide/c52wlan.html#wp1209597) to isolate the clients from each other. Does anybody know if only unicast traffic is blocked or also multicast and broadcast traffic like arp requests?
Concerning blocking p2p traffic of clients connected to the same ssid but different controllers I found the following statement in the LAP FAQs (http://www.cisco.com/en/US/products/hw/wireless/ps430/products_qanda_item09186a00806a4da3.shtml):
===
Q. In autonomous APs, Public Secure Packet Forwarding (PSPF) is used to avoid client devices associated to this AP from inadvertently sharing files with other client devices on the wireless network. Is there any equivalent feature in Lightweight APs?
A. The feature or the mode that performs the similar function of PSPF in lightweight architecture is called peer-to-peer blocking mode. Peer-to-peer blocking mode is actually available with the controllers that manage the LAP. If this mode is disabled on the controller (which is the default setting), it allows the wireless clients to communicate with each other through the controller. If the mode is enabled, it blocks the communication between clients through the controller. It only works among the APs that have joined to the same controller. When enabled, this mode does not block wireless clients terminated on one controller from the ability to get to wireless clients terminated on a different controller, even in the same mobility group.
===
Does anybody know what's the best practise to prevent this inter wlc client traffic? I already read about using acls on the wlc dynamic interfaces, or private vlans on the l2 switch vlans where the dynamic interfaces are connected to. Is it allowed to completely isolate the wlc from each other on these dynamic interfaces with acls or private vlans or do the wlc need to see each other on this interfaces (e.g. heart beat)?
Many thanks in advance,
Thorsten

Hi Sasha,Thorsten
The bug is Junked and I believe which is what you are running into with your tests:
CSCtr60787 WLC P2P Blocking Set to Forward-UpStream Doesn't Work.
Bugtoolkit : http://tools.cisco.com/Support/BugToolKit/action.do?hdnAction=searchBugs
To answer your original query :
ACL is only solution to block client communication on same ssid between 2 wlcs. 5508 works better with ACLs then 44xx platform.
ARP requests will be forwarded to upstream router just like any other traffic. WLC won't proxy arp for clients on same vlan.
Gateway arp's I believe should be handled by WLC . ( Don't quote me on this but I am pretty sure it is ) ..If it was not, then how would client know about gw ?
Multicast traffic is not applicable for p2p.
Your ACL can be as simple as this for the scenario :
WLC 1 - clientvlan = 10
WLC 2 - clientvlan = 10
and you want to restrict users from wlc1-wlc1, wlc1-wlc2, wlc2-wlc2 for same vlan10.
Basically in that case the ACL should look like on both WLCs :
1. Permit statement to talk to gateway.
2. Deny to subnet.
3. Permit all.
4. If DHCP/DNS other services are on same subnet then you would need to add a permit
statement before the deny.
5. Attach the ACL to SSID or dymanic interface.
Thanks..Salil
CSCtr60787 WLC P2P Blocking Set to Forward-UpStream Doesn't Work.

Blocking on a Router

I have enabled blocking on a router to fire when a certain sig fires. this has been working for a while, I can see the ACL on the router with the host being denied access,so I know that it has been working. The sig fired today and the host was added to the ACL on the router - so it should be blocked, right? After I verified that the host was added to the ACL on the router and through the IDM I still receive e-mails on this sig firing with the same host that was supposedly blocked when it first came in. Does the IPS still log events if though the attacker is being blocked?

Once the host was added to the ACL I was receiving alerts 10-20 minutes after the fact.
When you setup a router for the IPS to manage and you put in all of the login, IP and ACL info. Is there anything you have to do to make the ACL active on the router to deny or allow traffic? The only thing that I can think of is to assign it to an interface on the router but that was done when setting up the blocking device through IDM right?

Parallel participants blocks in External Routing Service

I'm trying to configure an External Routing service (it implements IAssignmentService interface) as described in Developer's Guide for Oracle SOA Suite[1].
The assignment stage configuration needed: one or more parallel participants blocks in the same stage, each one configured with different participants and voting rules.
The CustomAssignmentService below shows my custom External Routing Service: when I try to add two or more parallel participants, only the first one it is assigned to the task.
I haven't found documentation: how can I implement parallel participants blocks in External Routing Service?
Product version: SOA Suite 11.1.1.6
References:
[1] http://docs.oracle.com/cd/E28389_01/dev.1111/e10224/bp_hwfmodel.htm#BABCFHCC
----------- CustomAssignmentService.java ------------------
package br.com.iprocess;
import java.util.Map;
import oracle.bpel.services.workflow.metadata.routingslip.model.*;
import oracle.bpel.services.workflow.metadata.routingslip.model.Participants;
import oracle.bpel.services.workflow.metadata.routingslip.model.ParticipantsType.*;
import oracle.bpel.services.workflow.task.IAssignmentService;
import oracle.bpel.services.workflow.task.ITaskAssignee;
import oracle.bpel.services.workflow.task.model.Task;
import oracle.bpel.services.workflow.IWorkflowConstants;
public class CustomAssignmentService implements IAssignmentService {
private final String OUTCOME_APPROVE = "APPROVE";
private final String OUTCOME_REJECT = "REJECT";
public Participants onInitiation(Task task, Map propertyBag) {
return createParticipant(task, propertyBag);
public Participants onReinitiation(Task task, Map propertyBag) {
return createParticipant(task, propertyBag);
public Participants onOutcomeUpdated(Task task, Map propertyBag,
String updatedBy, String outcome) {
return null;
public Participants onAssignmentSkipped(Task task, Map propertyBag) {
return null;
public java.util.List getAssigneesToRequestForInformation(Task task,
Map propertyBag) {
return null;
public java.util.List getReapprovalAssignees(Task task, Map propertyBag,
ITaskAssignee infoRequestedAssignee) {
return null;
public Participants createParticipant(Task task, Map propertyBag) {
ObjectFactory objFactory = new ObjectFactory();
Participants participants = objFactory.createParticipants();
participants.getParticipantOrSequentialParticipantOrAdhoc().add(addParticipantsGroup1(objFactory));
participants.getParticipantOrSequentialParticipantOrAdhoc().add(addParticipantsGroup2(objFactory));
return participants;
private Parallel addParticipantsGroup2(ObjectFactory objFactory) {
Parallel parallelParticipant = objFactory.createParticipantsTypeParallel();
ParallelCompletionCriteriaType vote = objFactory.createParallelCompletionCriteriaType();
ParameterType defaultOutcome = objFactory.createParameterType(OUTCOME_REJECT);
defaultOutcome.setType("STATIC");
vote.setDefaultOutcome(defaultOutcome);
String defaultPercentage = "51";
ParameterType percentageOfOutcome = objFactory.createParameterType(defaultPercentage);
percentageOfOutcome.setType("STATIC");
vote.getOutcomePercentage().add(percentageOfOutcome);
parallelParticipant.setAllResponders(vote);
Resource resource = objFactory.createResource();
resource.setValue("manager1, manager2");
resource.setIsGroup(false);
resource.setType("STATIC");
parallelParticipant.getResourceOrRoutingSlip().add(resource);
Resource resource2 = objFactory.createResource();
resource2.setValue("manager3");
resource2.setIsGroup(false);
resource2.setType("STATIC");
parallelParticipant.getResourceOrRoutingSlip().add(resource2);
return parallelParticipant;
private Parallel addParticipantsGroup1(ObjectFactory objFactory) {
Parallel parallelParticipant = objFactory.createParticipantsTypeParallel();
ParallelCompletionCriteriaType vote = objFactory.createParallelCompletionCriteriaType();
ParameterType defaultOutcome = objFactory.createParameterType(OUTCOME_REJECT);
defaultOutcome.setType("STATIC");
vote.setDefaultOutcome(defaultOutcome);
String defaultPercentage = "51";
ParameterType percentageOfOutcome = objFactory.createParameterType(defaultPercentage);
percentageOfOutcome.setType("STATIC");
vote.getOutcomePercentage().add(percentageOfOutcome);
parallelParticipant.setAllResponders(vote);
Resource resource = objFactory.createResource();
resource.setValue("operator1, operator2, operator3");
resource.setIsGroup(false);
resource.setType("STATIC");
parallelParticipant.getResourceOrRoutingSlip().add(resource);
return parallelParticipant;
}

I'm trying to configure an External Routing service (it implements IAssignmentService interface) as described in Developer's Guide for Oracle SOA Suite[1].
The assignment stage configuration needed: one or more parallel participants blocks in the same stage, each one configured with different participants and voting rules.
The CustomAssignmentService below shows my custom External Routing Service: when I try to add two or more parallel participants, only the first one it is assigned to the task.
I haven't found documentation: how can I implement parallel participants blocks in External Routing Service?
Product version: SOA Suite 11.1.1.6
References:
[1] http://docs.oracle.com/cd/E28389_01/dev.1111/e10224/bp_hwfmodel.htm#BABCFHCC
----------- CustomAssignmentService.java ------------------
package br.com.iprocess;
import java.util.Map;
import oracle.bpel.services.workflow.metadata.routingslip.model.*;
import oracle.bpel.services.workflow.metadata.routingslip.model.Participants;
import oracle.bpel.services.workflow.metadata.routingslip.model.ParticipantsType.*;
import oracle.bpel.services.workflow.task.IAssignmentService;
import oracle.bpel.services.workflow.task.ITaskAssignee;
import oracle.bpel.services.workflow.task.model.Task;
import oracle.bpel.services.workflow.IWorkflowConstants;
public class CustomAssignmentService implements IAssignmentService {
private final String OUTCOME_APPROVE = "APPROVE";
private final String OUTCOME_REJECT = "REJECT";
public Participants onInitiation(Task task, Map propertyBag) {
return createParticipant(task, propertyBag);
public Participants onReinitiation(Task task, Map propertyBag) {
return createParticipant(task, propertyBag);
public Participants onOutcomeUpdated(Task task, Map propertyBag,
String updatedBy, String outcome) {
return null;
public Participants onAssignmentSkipped(Task task, Map propertyBag) {
return null;
public java.util.List getAssigneesToRequestForInformation(Task task,
Map propertyBag) {
return null;
public java.util.List getReapprovalAssignees(Task task, Map propertyBag,
ITaskAssignee infoRequestedAssignee) {
return null;
public Participants createParticipant(Task task, Map propertyBag) {
ObjectFactory objFactory = new ObjectFactory();
Participants participants = objFactory.createParticipants();
participants.getParticipantOrSequentialParticipantOrAdhoc().add(addParticipantsGroup1(objFactory));
participants.getParticipantOrSequentialParticipantOrAdhoc().add(addParticipantsGroup2(objFactory));
return participants;
private Parallel addParticipantsGroup2(ObjectFactory objFactory) {
Parallel parallelParticipant = objFactory.createParticipantsTypeParallel();
ParallelCompletionCriteriaType vote = objFactory.createParallelCompletionCriteriaType();
ParameterType defaultOutcome = objFactory.createParameterType(OUTCOME_REJECT);
defaultOutcome.setType("STATIC");
vote.setDefaultOutcome(defaultOutcome);
String defaultPercentage = "51";
ParameterType percentageOfOutcome = objFactory.createParameterType(defaultPercentage);
percentageOfOutcome.setType("STATIC");
vote.getOutcomePercentage().add(percentageOfOutcome);
parallelParticipant.setAllResponders(vote);
Resource resource = objFactory.createResource();
resource.setValue("manager1, manager2");
resource.setIsGroup(false);
resource.setType("STATIC");
parallelParticipant.getResourceOrRoutingSlip().add(resource);
Resource resource2 = objFactory.createResource();
resource2.setValue("manager3");
resource2.setIsGroup(false);
resource2.setType("STATIC");
parallelParticipant.getResourceOrRoutingSlip().add(resource2);
return parallelParticipant;
private Parallel addParticipantsGroup1(ObjectFactory objFactory) {
Parallel parallelParticipant = objFactory.createParticipantsTypeParallel();
ParallelCompletionCriteriaType vote = objFactory.createParallelCompletionCriteriaType();
ParameterType defaultOutcome = objFactory.createParameterType(OUTCOME_REJECT);
defaultOutcome.setType("STATIC");
vote.setDefaultOutcome(defaultOutcome);
String defaultPercentage = "51";
ParameterType percentageOfOutcome = objFactory.createParameterType(defaultPercentage);
percentageOfOutcome.setType("STATIC");
vote.getOutcomePercentage().add(percentageOfOutcome);
parallelParticipant.setAllResponders(vote);
Resource resource = objFactory.createResource();
resource.setValue("operator1, operator2, operator3");
resource.setIsGroup(false);
resource.setType("STATIC");
parallelParticipant.getResourceOrRoutingSlip().add(resource);
return parallelParticipant;
}

How to block p2p applications(Bittorent like) with AIP-SSM-10?

Hi,
How to block p2p application using AIP-SSM-10 working with ASA5520?AIP is on promiscuous mode.
Thanks,
Siva

There are several signatures that detect p2p, for bit torrent there is 11020.0
Yahoo triggers: 5539.0, 11200.0, 11212.0, 11217.0 & 11219.0
etc..
Some are disabled by default though so please ensure you enable the ones that you need.
If you want to block these then you will have to use event actions that work in promiscuous setup for example request block connection and tcp reset. Please note that care must be taken when using these event actions.
For more information about the event actions please refer the link below:
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids12/idmguide/dmevtrul.htm#wp1069467

Block P2P software using ASA-AIP-SSM-20 module

Hello,
I have got a question about blocking P2P traffic on ASA AIP module. I have searched the forums and all I could find were solutions using regex, port block, MPF, but no AIP implementation example.
Could anyone point me in the right direction please ?
Many thanks,
Martin

Hello Paps,
Many thanks for your reply. I was searching the web like crazy for some solutions using IPS and it never occured to me that I could just simply look for the signature files on Cisco website.
Thank you very much again
With regards,
Martin

Blocking on external router

Hi,
i want to configure blocking on external router for some specfic signature, i already have access list on the outside interface to block some traffic and fragment packets with the name ACL_Router_External applied on interface outisde (G0/0)
when i configure blocking on IPS it create another ACL and applied to interface same interface in order to block.
how can i push ACL configuration from IPS to exisiting ACL (ACL_Router_External) ???
thanks

From the link that I posted, here are the steps that the IPS takes when building the ACL:
When the sensor starts up, it reads the contents of the two ACLs. It creates a third ACL with the following entries:
•A permit line for the sensor IP address
•Copies of all configuration lines of the Pre-Block ACL
•A deny line for each address being blocked by the sensor
•Copies of all configuration lines of the Post-Block ACL
The sensor applies the new ACL to the interface and direction that you designate.
In your case, you could use the ACL_Router_External as your Post-Block ACL. The IPS will add a permit for itself and a deny entry for the address being blocked. It will then append the existing ACL_Router_External entries that you already have configured before pushing the new combined ACL to the g0/0 interface.

Want to block P2P application using ASA5540

I want to block P2P application & IM using ASA with IPS built-in. I dont wanna use the ACL for all the ports because most of the P2P application using dynamic ports.

Aamir,
You can do this using the application layer inspection on the firewall.
Please take a look at the configuration guide given below.
http://www.cisco.com/univercd/cc/td/doc/product/multisec/asa_sw/v_7_2/conf_gd/firewall/inspect.htm#wp1479354
Rate this post, if it helps.
Cheers
Gilbert

Blocking p2p application traffic and tunneling

I need help ........
We have taken two ASA with AIP card, and have configured Active/Active , but user are using p2p and tunneling softwares . how can we block p2p and tunneling traffic ..
plz anyone reply me..........
regards

If you are using Firewall software 12.4(9)T and above, it has integrated policies to block or rate limit p2p application traffic using dynamically updateable application
definitions for newer p2p applications. KaZaA, Gnutella, BitTorrent, and eDonkey are currently supported.
You may also see this: http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00801e419a.shtml

Cisco 2911/K9 Block P2P / Torrent

Dear Experts,
We currently have a Cisco 2911/K9 router and I feel there's a chunk of people who are eating up our bandwidth.
I am no expert in this area, but I have searched endlessly and haven't been able to find much information on how to resolve this issue on this router or if it is even possible.
Could someone shed some light onto this? Is it possible with this current router and no extra hardware (maybe extra software) to somehow monitor/block/de-prioritize the P2P/Torrent users?
Thank you!
Kind regards,
PIU

Without any additional license or equipment, that's very hard to achieve.
The best way to solve that problem is to use an ASA-NGFW instead of the IOS-router.
If you have to stick with the router you could use Cisco Web Security (CWS) formaly known as Scansafe. But that needs also an additional license.
With only the router you could try some dirty hacks. For example you can deny all unwanted IPs (that of Facebook, Youtube ...) in an ACL. But that is very hard to manage. Or you could control the DNS-communication in a way that your DNS-server return an internal IP of your own webserver for all the unwanted domains.
But all in all, you are using the wrong tool for that problem.

Blocking p2p or setting up a firewall to only allow certain programs?

Hello there,
I have a wireless dual-n router (WRT610N) and a cable modem (CM100) both from linksys.
My problem is that we live in an aprtment with 6 people and sometimes the connection crawls even with 2-3 people using the internet. My concern is that my roommates are file sharing like hell sometimes and eating all the bandwith. We're talking 20second to load the google main page slow, no person should be making the network that slow when it's just me and them using it.
So I'm interested in options to block access to bandwith killing activities. Friends have recommended that I set up a firewall and only permit certain programs access but I have no idea how to go about doing this. Another option would be if their was just a way to limit their bandwith, I already have my computer set with the highest prioriety on the network and it doesn't help.
Please let me know of any solutions you can suggest for this problem it sucks to be dishing out extra for highspeed internet + powerboost just to have all of fizzle away the second the connection hits the router.

You cannot limit their computer's bandwidth, however if you know what time they are using the bandwidth and downloading from Internet you may block the Internet access for them using the Access Restrictions, you can enter their MAC Addresses and schedule a time when you want to Deny Internet Access for them...

Router 877 changing Ios

hi!
i dont know if it's the correct forum but i got a simple question that i would like to be answered.
Recently i brought a 877 adsl router with the advance security ios. I thought this ios supported 802.1q, but i don't think so. So i upgraded to advance ip services ios. This ios support 802.1q and vlan implementation. The router seems to work fine. Everything was configured through CLI.
My question: This upgrade can cause some kind of problem with router functionality? if so, which ones?
The configuration is very simple: no vpns and basic firewall configuration.
Thanks for your help.

Hi there,
IOS Upgrades Dont affect Router Functionality BUT the features available on the Device.
Min Flash Requirement is There as BackUp Images are Recommended. In case The New Image is Corrupt or things dont go as planned, We can Manually boot the Router from Rommon.
Its a Standard Practice in Production Environment so as to Maximize Uptime.
Regarding the Features Required the best Pactice is to Use Cisco Feature Navigator

Block P2P traffic

Hello,
I have tried the below configuration to block the P2P traffic.But still the users can download using utorrent client. How do I effectively block all the P2P traffic. Please help.
Class Map
class-map type inspect match-any ALL-P2P-PROTOCOLS
match protocol edonkey signature
match protocol gnutella signature
match protocol kazaa2 signature
match protocol fasttrack signature
match protocol bittorrent signature
class-map type inspect match-all P2P-PROTOCOL
match class-map ALL-P2P-PROTOCOLS
match access-group name INTERNET-ACL
class-map type inspect http match-any HTTP-PORT-MISUSE
match request port-misuse im
match request port-misuse p2p
match request port-misuse tunneling
Policy Map
policy-map type inspect http HTTP-PORT-MISUSE-POLICY
class type inspect http HTTP-PORT-MISUSE
reset
log
policy-map type inspect IN-TO-OUT-POLICY
class type inspect P2P-PROTOCOL
drop log
class class-default
drop log
class type inspect HTTP-ACCESS
inspect
service-policy http HTTP-PORT-MISUSE-POLICY
Also I am attaching the logs and 'show policy-map type inspect zone-pair IN-TO-OUT' output.
Please help me out.
Regards,
Tony

Hello Tony,
Okay. I have seen on the last couple of days that because of how this protocols are being tunneled or jumping from one port to another, etc. Its pretty difficult to blok it with ZBFW.
So instead of doing that I would like to check if we can block it with NBAR, can we give it a try ??? If yes, here is how
class-map match-any p2p
match protocol edonkey
match protocol fasttrack
match protocol gnutella
match protocol kazaa2
match protocol winmx
match protocol skype
match protocol cuseeme
match protocol novadigm
match protocol ssh
match protocol irc
policy-map P2P-DROP
class p2p
drop
Apply the policy to the user-facing (incoming) interface.
int xxxxx
You can verify the status by doing:
sh policy-map int xxx
sh ip nbar protocol-discovery
Let me know the result,
Remembe to rate all of the helpful posts
service-policy input P2P-DROP

Block P2P traffic on Cisco 5508 Controller

Is it possible to block outside P2P traffic on a guest wireless network using an ACL on the controller? I know we can do it our firewall but the question came up so I thought I would post and see what everyone thinks. TIA

Yes, ACLs can be applied to the WLC. I might suggest moving the ACL to the closest point, the FW if you are concern about internet traffic.
ACLs on Wireless LAN Controllers: Rules, Limitations, and Examples
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a00807ce372.shtml

Messages from my computer being blocked by my router

I keep seeing the following messages in my routers log. They are only coming from my powerbook's IP:
[INFO] Sat Apr 01 22:56:44 2006 Blocked outgoing TCP packet from <my ip:port> to <an outside ip:port> as RST:ACK received but there is no active connection
[INFO] Sat Apr 01 22:55:40 2006 Blocked outgoing TCP packet from <my ip:port> to <outside ip:port> as FIN:ACK received but there is no active connection
They aren't occasional. Last night i show almost 70 in a row to only two ips over ten minutes. I wasn't able to trace these 2. I've been noticing this for a couple days, but I am sure thats just because I have been looking. A few i have been able to use the network utility and find out the domain and some of those have been sites I had been looking at in Safari. Others were not.
What is my computer doing? Mine seems to be the only ip registering this kind of activity in my router's log.
Powerbook G4 1.5ghz Mac OS X (10.4.5)

I should have asked what the destination port is...
but anyway, have you tried running tcpdump to see the
traffic? It might provide a clue. If you're not
familiar with it, you will have to open a Terminal
window and type:
sudo tcpdump -v
and enter the administrative password when prompted.
To get more detail, add more "v"s, e.g.
sudo tcpdump -vvv
will give you lots of information.
Thanks. I will try. I'm not familiar with the Terminal at all though.

Blocking p2p on router 877

Similar Messages

Maybe you are looking for