By default, IPS blockmode is enabled. To disable IPS blockmode, restore IPS blockmode, or force blocking for all IPS rules, use one of the ips blockmode commands.
Note
You can also run this command remotely from the command line of an integrated Central Management System appliance using the central management appliance proxying mechanism.
Syntax
ips blockmode disabled | no ips blockmode | ips blockmode all
Parameters
On an IPS-enabled appliance deployed inline and with a monitoring interface configured for inline deployment, manage the IPS blockmode setting.
ips blockmode disabled
Disable IPS blockmode. Traffic that matches an active IPS rule is allowed to pass, even for IPS rules that specify blocking. With IPS blockmode disabled, the appliance operates in detection-only mode for IPS rules. Matched traffic can still generate a IPS event, IPS alerts, and (if configured) IPS event notifications.
no ips blockmode
Re-enable IPS blockmode. Traffic that matches an active IPS rule is blocked or allowed as specified by the block action of the rule. If the matched IPS rule specifies the block action value blockable, the system handles the matched traffic as if the block action value were noblock, except that you can override the blockable action on a per-rule basis only.
ips blockmode all
Force all matched IPS rules to block traffic. Traffic that matches an active IPS rule is blocked, even for IPS rules that specify no blocking. Matched traffic can still generate an IPS event and (if configured) IPS event notifications.
Examples
ips blockmode disabled
hostname (config) # ips blockmode disabled
no ips blockmode
hostname (config) # no ips blockmode
ips blockmode all
hostname (config) # ips blockmode all
User role
Admin
Command mode
Config
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Network Security: Release 7.2.0. The ips blockmode all form of the command was introduced in Release 7.5.0.