Event guard blocking time length

[ou812]

Event guard shows the same ip address trying an IP & Auth login attempt and is blocked every 1 min. Is this ip address blocked for a certian amount of time and the event guard is just showing there attemps? or is it only blocking for 1 min at a time.

 

[markjcrane]

This means your iptables firewall is likely not working.

You can verify if it's blocked using this command.

iptables -L -n | less

There are two iptables

• sip-auth-fail
• sip-auth-ip

If it's not in the list then it's not getting added to iptables. I would check to see if you are updated.

 

[ou812]

This means your iptables firewall is likely not working.

You can verify if it's blocked using this command.


There are two iptables

• sip-auth-fail
• sip-auth-ip

If it's not in the list then it's not getting added to iptables. I would check to see if you are updated.

Thanks Mark, that was the issue, I restarted the event guard service which populated the 2 missing lines in Iptables.