IP ban using the CLI

Administrators can use the following command to manage the banned IP address list:

# diagnose user banned-ip {list | add | delete | clear | stat}

Option	Description
list	List banned IPs.
add	Add banned IP address.
delete	Delete banned IP address.
clear	Clear all banned IP addresses.
stat	Statistics

To add an IP address to the ban list:

# diagnose user banned-ip add <src4 | src6> <src-ipv4 | src-ipv6> <expiry> <admin | dlp | ips | av | dos | app>

Setting the expiry time to 0 results in an indefinite expiry time. If this is combined with the banned-ip-persistency (either permanent-only or all), the ban becomes permanent.

Example

In this example, a client PC is configured with the IP address 172.16.200.55, and an administrator adds the IP address to the IP ban list.

To add an IP address to the ban list:

# diagnose user banned-ip add src4 172.16.200.55 2 admin

To view the banned IP list:

# diagnose user banned-ip list
src-ip-addr       created                  expires                  cause           
172.16.200.55       Tue Jan 16 14:46:00 2024 Tue Jan 16 14:56:00 2024 Administrative

To verify that the banned IP list is working:

1. From the client with the banned IP address of 172.16.200.55, send a DNS query for a domain that is configured on the Central DNS server.

2. Go to Log & Report > Forward Traffic, and search for IP address 172.16.200.55.

3. View the log details in the GUI, or download the log file.

   In the following log file example, action is deny for source IP 172.16.200.55.

   date=2024-01-16 time=14:48:43 eventtime=1705445143824107713 tz="+1200" logid="0000000013" type="traffic" subtype="forward" level="notice" vd="root" srcip=172.16.200.55 srcname="DESKTOP-644U0A1" srcport=55619 srcintf="port2" srcintfrole="undefined" dstip=8.8.8.8 dstport=53 dstintf="port1" dstintfrole="undefined" srccountry="United States" dstcountry="United States" sessionid=259700 proto=17 action="deny" policyid=1 policytype="policy" poluuid="f4fe48a4-938c-51ee-8856-3e84e3b24af4" policyname="client_yt_v4" service="DNS" trandisp="noop" duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 rcvdpkt=0 appcat="unscanned" crscore=30 craction=131072 crlevel="high" srchwvendor="VMware" devtype="Server" srcfamily="Virtual Machine" osname="Windows" srcswversion="10" mastersrcmac="00:0c:29:a6:5a:94" srcmac="00:0c:29:a6:5a:94" srcserver=0