topic Vulnerability Protection - BlockIP in General Topics

Vulnerability Protection - BlockIP

1stalliance — Thu, 10 May 2012 14:22:09 GMT

I have configured a vulnerability protection profile to blacklist the ip addresses of attackers for all brute force login attempts with the signatures provided in the threat database. The profile works very well. However, i would now like to see the list of currently blacklisted ip addresses. I know it only blacklists for up to an hour, but there has to be a command to show the current ip addresses on the blacklist.

If anyone knows it, please assist me.

Thanks.

Richard

Re: Vulnerability Protection - BlockIP

jseals — Sun, 13 May 2012 18:32:46 GMT

Hi Richard,

I haven't found a command just yet, but you should be able to goto the threat logs in the webUI, create an action filter that equals "block-ip" and run the filter in the logs.

This should show you what IPs are getting blocked and when. On a side note, for this to be more real-time, you may want to enable logging at the start of the session for the rule that's logging your block-ip threats.

-Jason

Re: Vulnerability Protection - BlockIP

mikand — Mon, 14 May 2012 07:10:13 GMT

Shouldnt "log on session end" be equal as "log on session start" in this case since the ip is being blocked and hence the session is ended by the firewall?

I mean comparing with last "deny & log" rule in the bottom of your ruleset. Since the session its denied it shouldnt matter if you select "log on session start" or "log on session end".

Re: Vulnerability Protection - BlockIP

Fujitsu_cyberSOC — Mon, 14 May 2012 15:35:46 GMT

Hello,

You can try:

debug dataplane show dos block-table

best regards,