Unblock an ip after the block-ip action

[jmayne]

Is there a way other than waiting for the timeout to expire to remove an ip from the list of blocked ip's once it is blocked by a rule with an action of block-ip? I hope that makes sense .

Thanks,

Jim

[goku123 · Accepted solution]

Are you looking for something similar to https://live.paloaltonetworks.com/message/19545#19545 ?

There is also a clear command : > clear dos-protection zone <zone name> blocked source <IP>

[jmayne]

achitwadgi,

  Yes that was what I was looking for. I will second the feature request to display and remove entries that have been blocked either by a vulnerability or a zone protection rule.

Thanks,

Jim

[goku123]

Hi,

Please try the show command:  'ash@bv-tx1-pa200> show dos-protection zone <ingress_zone> blocked source '  and check if your profile blocked IP is listed. If it is listed here, then the following clear command should be able to clear it:

clear dos-protection zone <zone name> blocked source <IP>'

I havnt tested it recently but I think the above show / clear command may work for IPs blocked by brute force vulnerability signatures as well.

[HITSSEC]

Achitwadgi,

The command:

clear dos-protection zone (zone name) blocked source (IP address) 

works fine for sources that are blocked as a result of the action Block IP regardless of the signature used to trigger the action.  You can either clear all IP addresses in the zone or just an individual IP address.

Phil