topic Re: How do I reset a PA activated address block action? in General Topics

How do I reset a PA activated address block action?

HITSSEC — Mon, 08 Apr 2013 17:23:14 GMT

Since you are able to Block the source and/or destination IP address as an action taken in a protection rule (IPS, Spyware, Zone protection etc...) is there a way to reset the timer before the elapsed time has been reached. If you block for 3600 seconds and find out 5 minutes after the event took place that it is a false alarm do you have the ability to allow access through the issuance of a command or do you have to wait it out?

Phil

Re: How do I reset a PA activated address block action?

zarina — Mon, 08 Apr 2013 17:44:08 GMT

You can clear the DoS table:

debug dataplane show dos block-table

clear dos-protection zone <sourcezone> blocked source <ip-addr>

Re: How do I reset a PA activated address block action?

HITSSEC — Mon, 08 Apr 2013 18:12:45 GMT

Thanks sdarapuneni. That's great to know.

Phil