Vulnerability Protection - BlockIP

[1stalliance]

I have configured a vulnerability protection profile to blacklist the ip addresses of attackers for all brute force login attempts with the signatures provided in the threat database.  The profile works very well.  However, i would now like to see the list of currently blacklisted ip addresses. I know it only blacklists for up to an hour, but there has to be a command to show the current ip addresses on the blacklist.

If anyone knows it, please assist me.

Thanks.

Richard

[jseals]

Hi Richard,

I haven't found a command just yet, but you should be able to goto the threat logs in the webUI, create an action filter that equals "block-ip" and run the filter in the logs.

This should show you what IPs are getting blocked and when. On a side note, for this to be more real-time, you may want to enable logging at the start of the session for the rule that's logging your block-ip threats.

-Jason

[mikand]

Shouldnt "log on session end" be equal as "log on session start" in this case since the ip is being blocked and hence the session is ended by the firewall?

I mean comparing with last "deny & log" rule in the bottom of your ruleset. Since the session its denied it shouldnt matter if you select "log on session start" or "log on session end".

[Fujitsu_cyberSOC]

Hello,

You can try:

debug dataplane show dos       block-table

best regards,