How to Suddenly Block One Domain Device from Internet Access?

[davtt]

We have an issue where an unknown computer hogs our limited internet bandwidth and we need to immediately block it. This is a Windows Domain with 2008R2 servers, about 70 varying computers & devices, and a Cisco 1721 Router as internet gateway. Internet use is monitored with NTOP and we can see the offending computer's name, ip & mac address. But sometimes we don't know the machine's user or location, and can't quickly stop it.

Can you suggest an extra device that allows quick blocking, by mac or ip address? A free software firewall on a dedicated computer, or a hardware security appliance, that would be passing & monitoring all traffic between the Cisco router & the LAN.

We don't have a lot of router expertise. Our router person says it is hard to suddenly block one ip address, because to avoid a reboot, we have to replace an entire section in the run config so that the command is near the top and executed in the correct order. From the router CLI it's the last command and preceeding commands allow it through anyway. (something like that.)

We are a non-profit in a remote location in a remote country. Budget is a big issue.

I've done some research but its a large field and not my one and we are overdue to handle this. A proxy-cache server would be an added bonus. Smoothwall? Untangle? ClearOS? Zentyal?? ...

Thank you so much

 

[Outlander_04]

If it is always the same computer surely you can track it and work out why its sucking up bandwidth ?

 

[bill001g]

You router person is not very bright if he does not know how edit a simple access list. If he still think you have to delete a access list to replace it he has not read a cisco book in 10 yrs.

All you have to do is insert a deny for that one IP address with a lower number and it inserts at the top. If have done it a lot and run out of number there is a command to renumber the access list.

On a cisco commercial router there are probable 10 ways to do this.

Another simple but rather unconventional way to block this is to intentional ARP poison the ip. All you need to do it use the arp command and put in a static arp entry with a mac address you just make up.

 

[davtt]

We now have have the arp poisoning suggestion working, and are getting up to speed on the ACLs.

Thank you!