topic Re: How to show blocked IPs and how to remove a blocked IP in General Topics

How to show blocked IPs and how to remove a blocked IP

JoergK — Tue, 02 Oct 2012 08:33:11 GMT

Hello,

is it possible to show a list of automatically blocked IP addresses (example: Threat prevention for Brute-Force Attacks).
And is it possible to remove an IP from that list?

Thanks
Jörg

Re: How to show blocked IPs and how to remove a blocked IP

ppatel — Tue, 02 Oct 2012 08:54:13 GMT

Hi Jorg,

As far as I can recall, there is a work around to get the list of ip-addresses that the firewall block by threat.

You can create a custom report for the threat log to query action==deny. Or you can filter the threat logs with action eq deny as follows and export to csv.

In order to allow that threat or in case of False positive you can add an exception to threat in the security profile that is configured under Objects > Security Profiles >Antivirus > select the profile > Virus Exception

You cannot create an exception to an ip-address in the security profiles.

Let me know if that helps.

Regards,

Parth

Re: How to show blocked IPs and how to remove a blocked IP

JoergK — Tue, 02 Oct 2012 09:29:27 GMT

OK, thanks!
Actually I don't want an exception. I just want to remove an IP, if it is blocked after testing.
It's OK for me. The time I set for blocking is expired
In future I'll test with a short time and if it works, I'll increase the time

Regards

Jörg

Re: How to show blocked IPs and how to remove a blocked IP

sspringer — Tue, 02 Oct 2012 13:50:49 GMT

Hello,

Currently there is no way to view/add/remove from the list of IPs that are blocked via vulnerability profile 'block-ip' option. There is a feature request open and I would recommend reaching out to your sales team so we can work to add this feature in a future release.

*EDIT* -- there is option to show/reset the block-table

> debug dataplane show dos block-table

> debug dataplane reset dos block-table

Cheers,

Stefan

Re: How to show blocked IPs and how to remove a blocked IP

JoergK — Tue, 02 Oct 2012 14:33:56 GMT

OK, thanks!

Re: How to show blocked IPs and how to remove a blocked IP

EricStoltz-Consultant — Thu, 01 Feb 2024 04:16:22 GMT

Did that feature request ever get implemented?

Re: How to show blocked IPs and how to remove a blocked IP

DLONGPRÉ — Thu, 02 May 2024 17:32:00 GMT

I'm wondering the same! 😕

Re: How to show blocked IPs and how to remove a blocked IP

ChuckW — Fri, 07 Jun 2024 04:07:30 GMT

According to recent documentation, April 2024, every version from 9.1 to 11.1 are *supposed* to have a "Blocked IP" option under the Monitor tab.

I don't see it via Panorama or directly on the device, however, I just added the block-ip to a couple of vulnerabilities and maybe (far reaching) the firewall has to block an IP address before that option populates under the Monitor tab?
Strange that PAN has not responded to this question.

See this link for 9.1

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/monitor/monitor-block-ip-list/view-or-delete-block-ip-list-entries#id64111e01-ea45-4248-8883-12db9fec1f6c

Re: How to show blocked IPs and how to remove a blocked IP

EricStoltz-Consultant — Fri, 07 Jun 2024 11:53:32 GMT

So after more research in the wild it appears the larger firewalls have a block ip list in the monitor tab. It’s between session browser and botnet. It’s on the 5220s that I’m working with but not the azure vm firewalls nor the 440s in my lab. Strange that there is a hardware difference in this functionality.

Re: How to show blocked IPs and how to remove a blocked IP

ChuckW — Fri, 07 Jun 2024 14:07:23 GMT

I can confirm that the option exists on older 5260s and new 5420s, but does not exist on newer 3430s

Is the a 5000-series option?

What happens if you have the Action set to Block IP but you don't have the Monitor - Block IP List to see them? (still blocked for the configured time?).

The randomness of features between series is proving very frustrating.