Block for UNC3886-C2 Firewall

[victorjames]

Please help to advise this setting can work or ?

config firewall address
edit "UNC3886-C2"
set type iprange
set start-ip 45.32.12.34
set end-ip 45.32.12.34
next
end

config firewall addrgrp
edit "APT-Blocklist"
append member "UNC3886-C2"
next
end

config firewall policy
edit 100
set name "Block APT C2"
set srcintf "any"
set dstintf "any"
set srcaddr "all"
set dstaddr "APT-Blocklist"
set action deny
set logtraffic all
set schedule "always"
set service "ALL"
set match-vip enable ← if blocking VIP or incoming traffic
set position 1 ← ensures this deny rule comes before any broader allow rules
next
end

[fiesta]

Hi,

If this is virtual IP, this address group "APT-Blocklist" should be in source address since it is internet IP range and destination address should be the VIP object created in Policy and Object -> Virtual IP.

Best regards.

FWD~