I have a problem with the quarantine with the "ip_src_session" of a Dos policy.
The Policy is also set to Block and the log "anomaly" returns the ip that exceed the threshold of 200.
But the IP doesn't go to quarantine...
Obviously I set the quarantine commands via cli.
Commands: set quarantine-attacker and set quarantine-expiry 1d.
Another thing: I have a Dos policy before this that for a specific source address don't do anything.
Is a exception for a specific source IP to understand, but I don't think it matters much.
Anyone can help me?