topic Block vs block ip in General Topics

Block vs block ip

NetworkGeek — Wed, 22 Mar 2017 16:28:57 GMT

Hello all,

what is difference between Block and Block ip ?

Block for this current packet only ? Block ip for specific ip for certain time

is it correct ? so Block IP is better

Re: Block vs block ip

rmfalconer — Wed, 22 Mar 2017 16:59:34 GMT

Block IP blocks traffic from either a source or source+destination for a specified amount of time.

Block has been replaced by 'Reset Both' in PAN OS 7. It sends a TCP reset to both client and server or just drops UDP.

Re: Block vs block ip

NetworkGeek — Wed, 22 Mar 2017 18:29:47 GMT

Block is still an option with my os now (7.1.8)

so it reset each packet right ?

Re: Block vs block ip

BPry — Wed, 22 Mar 2017 21:10:14 GMT

@NetworkGeek

The difference between Block and Block IP is Block IP will stop any future communication for x seconds, while Block will only drop all traffic from the source to the destination that is actually currently open. If you are taking the time to setup DoS then utilize Block IP and keep the standard of 300 seconds once you have everything baselined. Most automated scans or attacks will move on to the next target if they don't recieve any traffic after a certain amount of time.

Allow: Permits the port scan attempts.

Alert: Generates an alert for each scan that matches the threshold within the specified time interval.

Block: Drops all traffic from the source to the destination.

Block IP: Drops all traffic for a specific period of time (in seconds). There are two options:

• Source: Blocks traffic from the source

• Source-and-Destination: Blocks traffic for the source-destination pair

Re: Block vs block ip

NetworkGeek — Thu, 23 Mar 2017 07:51:29 GMT

Thank you , this is exactly what i was looking for..