topic Re: Unblock an ip after the block-ip action in General Topics

Unblock an ip after the block-ip action

jmayne — Thu, 08 Aug 2013 20:01:28 GMT

Is there a way other than waiting for the timeout to expire to remove an ip from the list of blocked ip's once it is blocked by a rule with an action of block-ip? I hope that makes sense .

Thanks,

Jim

Re: Unblock an ip after the block-ip action

goku123 — Thu, 08 Aug 2013 20:14:29 GMT

Are you looking for something similar to https://live.paloaltonetworks.com/message/19545#19545 ?

There is also a clear command : > clear dos-protection zone <zone name> blocked source <IP>

Re: Unblock an ip after the block-ip action

jmayne — Thu, 08 Aug 2013 20:22:14 GMT

achitwadgi,

Yes that was what I was looking for. I will second the feature request to display and remove entries that have been blocked either by a vulnerability or a zone protection rule.

Thanks,

Jim

Re: Unblock an ip after the block-ip action

goku123 — Thu, 08 Aug 2013 20:33:21 GMT

Hi,

Please try the show command: 'ash@bv-tx1-pa200> show dos-protection zone <ingress_zone> blocked source ' and check if your profile blocked IP is listed. If it is listed here, then the following clear command should be able to clear it:

clear dos-protection zone <zone name> blocked source <IP>'

I havnt tested it recently but I think the above show / clear command may work for IPs blocked by brute force vulnerability signatures as well.

Re: Unblock an ip after the block-ip action

HITSSEC — Fri, 09 Aug 2013 02:24:57 GMT

Achitwadgi,

The command:

clear dos-protection zone (zone name) blocked source (IP address)

works fine for sources that are blocked as a result of the action Block IP regardless of the signature used to trigger the action. You can either clear all IP addresses in the zone or just an individual IP address.

Phil