Cisco Cisco Firepower Management Center 4000

Select 

.

The Modules page appears.

Perform one of the following actions:

Click 

 to view the module. 

The Module Detail page appears.

Click 

 next to the module you want to delete. You cannot delete default modules provided by 

Cisco.

The remediation module is deleted.

FireSIGHT

Cisco provides a Cisco IOS Null Route remediation module that allows you to block a single IP address 
or an entire block of addresses using Cisco’s “null route” command when a correlation policy is violated. 
This forwards all traffic sent to the host or network listed as the source or destination host in the event 
that violated the correlation policy to the router’s NULL interface, causing it to be dropped (note that 
this will not block traffic sent from the violating host or network).

The Cisco IOS Null Route remediation module supports Cisco routers running Cisco IOS 12.0 and 
higher. You must have level 15 administrative access to the router to execute Cisco IOS remediations.

A destination-based remediation only works if you configure it to launch when a correlation rule that is 
based on a connection event or intrusion event triggers. Discovery events only transmit source hosts.

When a Cisco IOS remediation is activated, there is no timeout period. To remove the blocked IP address 
or network from the router, you must manually clear the routing change from the router itself.

Admin/Discovery Admin

Enable Telnet on the Cisco router.

Refer to the documentation provided with your Cisco router or IOS software for more information about 
enabling Telnet.

On the Defense Center, add a Cisco IOS Null Route instance for each Cisco IOS router you plan to use 
with the Defense Center.

See 

 for the procedures.

Create specific remediations for each instance, based on the type of response you want to elicit on the 
router when correlation policies are violated.

Each available remediation type is described in the following sections: