Hello Mohammad
There are three type of blocks on the Cisco IPS, connection block enabled referred to the blocks that match no both source/dest etc. and not just the source. From the user guide:
"There are three types of blocks:
•Host block-Blocks all traffic from a given IP address.
•Connection block-Blocks traffic from a given source IP address to a given destination IP address and destination port.
Multiple connection blocks from the same source IP address to either a different destination IP address or destination port automatically switch the block from a connection block to a host block.
--------------------------------------------------------------------------------
Note Connection blocks are not supported on firewalls. Firewalls only support host blocks with additional connection information.
--------------------------------------------------------------------------------
•Network block-Blocks all traffic from a given network.
You can initiate host and connection blocks manually or automatically when a signature is triggered. You can only initiate network blocks manually.
--------------------------------------------------------------------------------
Caution Do not confuse blocking with the sensor's ability to drop packets. The sensor can drop packets when the following actions are configured for a sensor in inline mode: deny packet inline, deny connection inline, and deny attacker inline. "
Please rate if helpful.
Regards
Farrukh
