Avatar of Brian Gorsky
Brian Gorsky
Flag for United States of America

asked on 

How do I unblock a Blacklisted IP in Cisco Firepower?

I have a Cisco ASA 5525 with the FirePower module. I manage it through the CIsco Firepower Mgmt Center for VMWare. We had gotten an alert (below) and I right-clicked on the entry and blacklisted the IP. I have since determined it was likely a false positive but cannot figure out how to unblock the IP.
"MALWARE-CNC PCRat variant outbound connection" [Impact: Unknown] From "PDASAFIREPOWER" at Thu Apr  2 22:11:12 2020 UTC [Classification: A Network Trojan was Detected] [Priority: 1] {tcp} 166.151.xxx.xxx:59525 (united states)->172.20.xxx.xxx:1901 (unknown)
I removed it from the Global-Blacklist and added it to the Global-Whitelist but it is still being blocked when I look in the Connection Events. The reason for the block is "IP Block" - when I right-click on the entry and click Exclude, it doesn't seem to do anything.
Hardware FirewallsCiscoNetworking

Avatar of undefined
Last Comment
Brian Gorsky

8/22/2022 - Mon