IOS IPS Blocking Question

[Kryptkeeper]

All,

     I have been playing with IOS IPS. I set up an event action override to block when a certain risk rating was triggered. It worked correctly as expected. Then when I changed the risk rating, in the event action override, where it shouldn't have blocked the traffic, the traffic was still denied.

     I tried searching for a command to view block attackers but couldn't find anything. Is there a way to view who is blocked, and unblock? Any assistance would be appreciated. Thanks.

[Dustin Ralich]

Are you sure this is on an IOS IPS device (i.e. setup in the IOS software itself on a router) or is it an actual sensor device (AIM-IPS sensor module, NME-IPS sensor module, 4200-series sensor appliance, etc.)?

Can you post a copy (or readable screenshot) of the relevant portions of your config?

On IPS devices, if you invoke a Deny Attacker Action, it will remain in effect for 1 hour (by-default). Likewise, Request Block Actions remain in effect for 30 minutes (by-default). So, if such an Action was triggered, even if future traffic from the same host did not match your modified EAO, the Action(s) would still be in-place for the duration of the timer(s).

In that regard, on IPS devices, you can view the current Denied Attackers list via the 'show statistics denied-attackers' command and the Blocked Hosts list via the 'show statistics network-access' command.