IP ban using security profiles

Configure one or all of the security profiles to quarantine all traffic originating from the infected host’s IP address for a configurable duration. The IP address of the attacker is also incorporated into the list of banned users. The address of the target remains unaffected.

The following types of security profiles can be used to ban IP addresses:

• Antivirus

• Application control

• DLP

• IPS

Antivirus

To ban IP addresses using an antivirus profile:

1. Configure an antivirus profile:

   config antivirus profile
       edit <name>
       config nac-quar
       set infected quar-src-ip
       set expiry <duration>
    end
   

2. View the banned IP address:

   # diagnose user banned-ip list
   src-ip-addr       created                  expires                  cause            
   172.16.200.55       Wed Jan 17 13:06:05 2024 Wed Jan 17 13:08:05 2024 AV  
   

Application control

Quarantine is available as one of the action types when the application matches this application control profile. See Basic category filters and overrides for more information.

To ban IP addresses using an application control profile:

1. Configure the application control profile:

   config application list
       edit <name>
           config entries
               edit <id>
                   set quarantine attacker
                   set quarantine-expiry <duration>
               next
           end
       next
   end
   
   

2. View the banned IP address:

   # diagnose user banned-ip list
   src-ip-addr       created                  expires                  cause     172.16.200.55       Thu Jan 18 07:17:13 2024 Thu Jan 18 07:22:13 2024 APP  
   

DLP

Quarantine is available as one of the action types when the content matches this DLP profile. See Basic DLP settings for more information

To ban IP addresses using a DLP profile:

1. Configure the DLP profile:

   config dlp profile
       edit <name>        
           config rule
               edit <id>
                   set proto <protocols>
                   set action quarantine-ip
                   set expiry <duration>
               next
           end
       next
   end

2. View the banned IP address:

   # diagnose user banned-ip list
   src-ip-addr       created                  expires                  cause     172.16.200.55       Thu Jan 18 07:03:03 2024 Thu Jan 18 07:05:03 2024 DLP  
   

IPS

Quarantine is available as one of the action types when the signature matches this IPS profile. A protocol must also be set. See Configuring an IPS sensor for more information.

To ban IP addresses using an IPS profile:

1. Configure the IPS profile:

   config ips sensor
       edit <name>
           config entries
               edit <id>
                   set quarantine attacker
                   set quarantine-expiry <duration>
               next
           end 
   end
   

2. View the banned IP address:

   # diagnose user banned-ip list
   src-ip-addr       created                  expires                  cause            
   172.16.200.55      Thu Jan 18 06:42:06 2024 Thu Jan 18 06:44:06 2024 IPS