Cisco Cisco Firepower Management Center 4000

Select 

.

The Instances page appears.

Next to the instance where you want to add the remediation, click 

. 

If you have not yet added an instance, see 

.

The Edit Instance page appears.

In the 

 section, select 

 and click 

.

The Edit Remediation page appears.

In the 

 field, enter a name for the remediation.

The name you choose cannot contain spaces or special characters and should be descriptive. For 
example, if you have multiple Cisco IOS router instances and multiple remediations for each instance, 
you may want to specify a name such as 

IOS_01_BlockSrc

.

Optionally, in the 

 field, enter a description of the remediation.

Click 

, then click 

.

The remediation is added.

FireSIGHT

The Cisco IOS Block Source Network remediation allows you to block any traffic sent from the router 
to the network of the source host in a correlation event. The source host is the source IP address in the 
connection event or intrusion event upon which the correlation rule is based, or the host IP address in a 
discovery event.

Admin/Discovery Admin

Select 

.

The Instances page appears.

Next to the instance where you want to add the remediation, click 

. 

If you have not yet added an instance, see 

.

The Edit Instance page appears.

In the 

 section, select 

and click 

.

The Edit Remediation page appears.

In the 

 field, enter a name for the remediation.

The name you choose should contain no spaces or special characters and should be descriptive. For 
example, if you have multiple Cisco IOS router instances and multiple remediations for each instance, 
you may want to specify a name such as 

IOS_01_BlockSourceNet

.

Optionally, in the 

 field, enter a description of the remediation.

In the 

 field, enter the subnet mask or CIDR notation that describes the network that you want to 

block traffic to.