Appears IP is Blacklisted but not showing

[TCPC-Tech]

I’ve run into a branch IP being blacklisted (is my guess) even though the IP has a rule to 'Allow' under IP Blacklist.
People received a Disconnected message on Window App or there Webclient screen was black.
People had no issues access other websites.

I cannot locate in the event log or Activity Log the IP being blacklisted. The only reason why I'm guessing it was blacklisted was under Anti-Hacking I change the ‘Blacklist time interval’ to a low number and everything started to work shortly afterwards for the branch. This has occurred twice in the last 2 months.
All other branches and remote people were not impacted.

At about the time when the branch was 'blacklist' in the the logs I see this, but this is not our IP/subnet


We are running V20, Update 4

What am I missing that I need to change, or could it be anything issue?

 

[SteveITS]

Everyone was affected?

There's an "IP Blacklisted" notification you could enable.

3CX has a global blacklist they maintain for frequent abusers, but presumably that wouldn't expire based on your settings. Unless it was just chance.

 

[TCPC-Tech]

That is the other issue. The IP Blacklist notification is enabled. We have received these notifications for other IPs, just not when this branch have been blacklisted (appears).
Maybe I need remove the Allow Rule for the branch IP and see if this occurs again? Maybe I will get some notification and see the IP blocked.

 

[NicholasP_3CX]

3CX has a global blacklist they maintain for frequent abusers, but presumably that wouldn't expire based on your settings. Unless it was just chance.

In the screenshot it is indicating that the IP was blacklisted by 3CX, meaning it is in the global IP Blacklist.

 

[SteveITS]

In the screenshot it is indicating that the IP was blacklisted by 3CX, meaning it is in the global IP Blacklist.

That would make sense but OP implied they could remove it by changing the blacklist timer. Could be coincidence as I mentioned.

Also the global blacklist wouldn't generate a notification so that would match the report.