Using firewall to reject malicious IP instance

Recently, many IP addresses have been seen on the production platform service to initiate a large number of threads, and it was originally intended to use APF or scripts to prevent these connections. But think about it. Why did you do it on the final defense? Here I use the firewall access control list denied on the line, consider the control list often maintain the operation trivial recommendations to create groups. Post my example:

object-group network deny_ddoshost 70.39.96.146object-group network permit_otheranyip access-list extended deny_ddosdeny ip object-group deny_ddos anypermit ip object-group permit_other anyinterface FastEthernet0/0/0description Out-Web80-1 (CNportal)ip address 115.85.150.130 255.255.255.248ip access-group deny_ddos inno ip redirectsno ip unreachablesno ip proxy-arpip nat outsideip virtual-reassembly induplex autospeed auto