Black list / white list

"Real time" table

Black list

This view shows the list of quarantined hosts. Hosts can be quarantined from:

  • The pop-up menu available in certain log and monitoring modules,
  • The alarm configuration module.

Possible operations:

Delete black list This button makes it possible to delete the selected blacklist entry from the table.

The "Black list" view displays the following data:

Host / Address range References the blacklisted (quarantined) IP address, name (if the host has been declared in the objects base) or IP address range.

Destination blocked

Indicates the destination (host, network, sub-network, address range) to which traffic from the quarantined host is blocked.

Expiry date

Indicates the date on which the host or address range in question will be released from quarantine.

White list

This view shows the list of hosts allowed to pass through the firewall without any action on its part (no filtering, no IPS analysis). Hosts can only be whitelisted from the command line and the aim of this feature is to not block hosts in production as part of an in-depth analysis of undesirable behavior on the firewall. The "White list" view displays the following data:

Host / Address range References the whitelisted IP address, name (if the host has been declared in the objects base) or IP address range.

Destination blocked

Indicates the destination (host, network, sub-network, address range) to which traffic from the whitelisted host is blocked.

Expiry date

Indicates the date on which the host or address range in question will be released from the whitelist.