I just want to verify if the following is working properly:
- Under Configuration > IPS > Sensor Monitoring > Time-Based Actons > Host Blocks is configured properly
I have entered in a few hosts to be blocked and I notice the following:
- Under Connection Block Enabled tab it shows "false" for any host that I enter in. ??????
Thank you in advance for your assistance.
False means that the blocking rule was not turned on (not enabled)
It means that someone might have configured the rule before, however, did not enable it.
If you click on the "Add" button, you would be able to see what I mean (the "Enable connection blocking" needs to be ticked to block the host configured), and it will show as "True" once you enable it.
Hope that answers your question.