IPS 5.1(3) never-block-networks not working

Question

Our Cisco IDS 4200 appliances have been converted from 4.1(x) to 5.1(3) with latest signature S252. I'm going through fine-tuning and enabling countermeasures step-by-step. One thing I noticed is that even though a never-block-host for our /19 CIDR is configured the IPS is still blocking IP's within that range. Am I correct in understanding the behavior of never-block-network with IPS 5.1(3) meaning never ever block, right? I'll try breaking it down into /24 since maybe it doesn't like /19.

Answer 1

Something else you may want to consider as a workaround.
Instead of solely relying on the NeverBlock list, you can also create event-action-filters in 5.1(3) that can remove the "request-block-host" and "request-block-connection" event actions.
In 4.1 the filters would remove the entire alert and all actions for the alert.
So if you tried to use filters to prevent the Blocks it would also keep you from seeing the alert in your alert viewer.
But in 5.0/5.1 you can now independantly remove actions from the event.
So you can create a filter for all signatures where the attacker address is the addresses you never want blocked, and remove the request-block-host and request-block-connection actions.
This way when the sensorApp/AnalysisEngine service triggers an event for the attack it will not even send the block request to the network access controller service, but will still go ahead and do the rest of the event actions that were configured on the signature.
There is also no a specific action in order to get an event to actually create an alert for viewing. This is event-action is "produce-alert".
So if the "produce-alert" and "request-block-host" event actions were both configured on the signature, then the filter can remove the "request-block-host" event action and still allow the "produce-alert" event action to happen.