Check point block a single IP address

 

Using Suspicious Activity Monitoring (SAM)

Connect to the firewall via SSH and log into Expert mode:

expert

Run the fw sam command to block traffic to and from the target IP:
fw sam -t 0 -b -s <IP_Address>
• -t 0 sets the timeout (0 means indefinite, or specify seconds like -t 3600 for 1 hour).
• -b blocks both source and destination directions.
• -s specifies the source IP address to block. [1]

Alternatively, for high-performance accelerated drops using SecureXL, you can use the fwaccel dos deny utility: [1]

fwaccel dos deny -a <IP_Address>

fw samp block -d <IP-Address> -u <Unique-Name>

fw samp unblock -u block_bad_ip