how can view wich ip blocked by ips

[bahramsport]

i have 2 q

1- how can i get list of ip address that blocked by my firewall?

2- how can i reset this list and allow attacker ip to access?

thanks

[emnoc]

You can look at the ban list but that's populated if you execute a ban and quarantine

e.g

get user ban list

or the following will list hosts

diagnose firewall ip_host list

to clear

diagnose firewall ip_host rem  src|dst  <ipv4 addr>

Is that what you want?

[bahramsport]

thanks a lot. . but I think this command show quarantine IP that blocked by IPS,but if IP blocked permanent by IPS , what command can show it? for example a hacker that blocked by IPS? thanks my dear

[emnoc]

You can look at the IPS alert event for one, but how are you blocking a client  ( mon | block | quarantine ) ? and for what duration if  it's quarantine ? is the real question.

When you set the sensor you have the option to block or monitor or  quarantine. Those commands will show you the latter and let you free the latter from the quarantine. That pretty much under the latest FortiOS. Is that clear ?

[bahramsport]

I set blocking client to block and don't use monitor or  quarantine. 

for example this command in junos show all blocked IP by juniper idp. i need similar this command in fortunate.

show security flow ip-action

[emnoc]

Here 's what i would suggested, take the siganture ensure logging is enable in the IPS sensor for the config entry

Ensure you have logging enabled on the policy;

config firewall policy     edit 27         set uuid 5f43b0b2-fe51-51e4-384f-1c9c8638ca71         set srcintf "wifi"         set dstintf "virtual-wan-link"         set srcaddr "all"         set dstaddr "GOOG1"         set action accept         set schedule "always"         set service "DNS"         set utm-status enable         set logtraffic all         set logtraffic-start enable         set ips-sensor "DNS"         set profile-protocol-options "default"         set nat enable     next end

Enable logging from log > config and from memory or forticloud  for the wegui display

Now go to  log & report > security > ips

That will show you all events, once again  the quarantine and the earlier commands shows you what's in quarantine, the time entered and expiry time.

FWWI each time your attacker hits the rule, it would be a new entry. Each entry will have a sequence number, timestamp, sensor-name, rule, and packet logging if you enabled it.

That's the best I can  pull up from memory ( no pun intended ), I don't know of any CLI cmd to see the above but you cam dump the log and grep or crunch the entries also.

[bahramsport]

thanks my dear.

my other q is :

for example a ip address x.y.w.z blocked by ips and this show in ips log

now i need unblock this ip from blocked list ?

how can i this ?