"Add source IP to Quarantine list" in Aggressive Aging

[Jose_Luis_Mart1]

Dear all,

While fine-tuning Aggressive Aging in a customer configuration, we've found that the Aggresive Aging IPS signature includes a parameter name "add souce IP to quarantine list".

The thing is that there are no details about this parameter. Is it a permanent block? Only for x seconds/minutes/hours? Is it configurable? Does it use SAM?

Does anyone know a bit more about this?

Thanks!

[PhoneBoy]

Where are you seeing this option?

I don't see it in either R80.x or R77.30 when I am looking at the Aggressive Aging signature in IPS (R77.30) or Inspection Settings (R80.x).

[Alejandro_Bayo]

Hi,

I think that Jose Luis is talking about this option (R77.30):

I've no idea about how this option work...

Best Regards,

Alex B.

[PhoneBoy]

This option doesn't show for me in R77.30 or R80.x

Will have to ask around on both counts.