How do I see the clients in quarantine?

Short answer

For the Load Balancer Quarantine action, the action name (QUARANTINE, duration) source is selected from the Logs Type list in the Logs & Tracking tab of the vService; the table lists the clients currently in quarantine with the Quarantine start and Quarantine expiry columns. A client is removed before its time expires with Remove from Table; the table is not refreshed automatically, Refresh is used. The Advanced CAPTCHA quarantine is a separate source in the same list; Bot/DDoS, AGS and L4 DDoS Protection, on the other hand, keep their own tables.

Problem: It Is Not Known Which Clients Are in Quarantine

After the quarantine rules take effect, it must be known which clients are blocked, when they will be released and how a user quarantined by mistake is set free. Each protection keeps its own quarantine table; a client appears in the table of whichever protection it is in.

Solution: Five Methods

The methods show the tables of different protections; the method of whichever protection quarantined the client is used.

Your situation	Suitable method
Load Balancer Quarantine action	Method 1: Logs & Tracking → QUARANTINE
Captcha quarantine is on in Advanced CAPTCHA	Method 2: Logs & Tracking → Advanced CAPTCHA source
Quarantine action or hard ceiling in Bot/DDoS protection	Method 3: Bot/DDoS Quarantine table
AGS Bot Protection Policies	Method 4: AGS Bot Protection tab
L4 DDoS Protection rule in Quarantine mode	Method 5: L4 DDoS Live View

Method 1: Logs & Tracking → QUARANTINE Recommended

• How it works When a Quarantine action is added to the vService, the quarantine table automatically appears as a source in the Logs & Tracking tab; no separate enabling is required (Quarantine (Quarantine) Logs). The table is not a saved history but the current content of the quarantine.
• Where it is opened Left Monitor Panel → Load Balancer vServices → vService → Logs & Tracking
• Requirement A vService with a Quarantine action added
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the Logs & Tracking tab

In the Left Monitor Panel, Load Balancer vServices is selected, the vService is clicked and the Logs & Tracking tab is opened (viewing).

2

Adım 2 Select the quarantine source

The action name (QUARANTINE, duration) entry is selected from the Logs Type list (e.g. karantina (QUARANTINE, 10m)). The table opens with the Quarantine start, Quarantine expiry and tracking key (e.g. ↓IP) columns. For the clients that are not yet quarantined but are being tracked, the (TRACKING, duration) source in the same list is used (Quarantine (Tracking) Logs).

3

Adım 3 Fetch the current content

Refresh is clicked; the list does not refresh on its own.

4

Adım 4 Select the client (to remove it)

The row or rows to be removed from quarantine are selected.

5

Adım 5 Remove from quarantine

Remove from Table is clicked and Are you sure? is confirmed. The client is released, and the paired tracking record is also cleared; the operation cannot be undone. The same operation is also available in the right-click menu.

Verification

1Quarantine tableTR7 side

After the removal, Refresh is clicked.

ExpectedThe client's row is not in the list

In a cluster setup, the device that holds the record appears in the Source column, which is hidden by default; the column is added from the Columns selector.

Method 2: Logs & Tracking → Advanced CAPTCHA Source

• How it works If Captcha Quarantine is on in the Advanced CAPTCHA action, the quarantine table of the clients that fail the verification appears as a separate source in the Logs & Tracking list.
• Where it is opened Left Monitor Panel → Load Balancer vServices → vService → Logs & Tracking
• Requirement An Advanced CAPTCHA action with Captcha quarantine on
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Logs & Tracking tab

Step 1 of Method 1 is applied.

2

Adım 2 Select the captcha quarantine source

In the Logs Type list, the (QUARANTINE, …) source of the Advanced CAPTCHA action is selected (captcha quarantine logs) and Refresh is clicked.

Verification

1TableTR7 side

The clients that fail the verification as many times as the threshold are listed.

ExpectedClient rows

Method 3: Bot/DDoS → Quarantine Table

• How it works In Bot/DDoS protection, a single penalty box is kept per vService; the sources quarantined by L7 DDoS Protection, IP Reputation Protection, Bot Protection and Captcha are listed in the same table with the Reason column (What is Quarantine).
• Where it is opened Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management → Quarantine card → Table →
• Requirement Bot/DDoS license; a protection that directs to the quarantine being in Active mode
• vService type HTTP · L7 TCP

Step-by-Step Configuration

1

Adım 1 Open the Bot/DDoS Management tab

Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management is opened.

2

Adım 2 Open the table

The Table → link at the bottom right of the Quarantine card is clicked; the table opens in a closable tab named Quarantine (Quarantine table).

3

Adım 3 Remove the source (if necessary)

The row is selected and Remove from Table is clicked.

Verification

1TableTR7 side

The sources in quarantine and the protection that quarantined them are listed.

ExpectedRows with the Reason column filled in

Method 4: AGS → Bot Protection Tab

• How it works The counter and block tables of an AGS Bot Protection Policies policy are seen by selecting the policy in the Bot Protection tab of the vService.
• Where it is opened Left Monitor Panel → AGS-Enabled vServices → vService → Bot Protection
• Requirement AGS license; a Bot Protection policy that is assigned to the vService and keeps a table (one whose trigger is Requests or Auth failures, or whose action is Block; the tab appears only in this case)
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the Bot Protection tab

Left Monitor Panel → AGS-Enabled vServices → vService → Bot Protection tab is opened.

2

Adım 2 Select the policy

The policy is selected with the Policy Selector and Refresh is clicked; the Counter rows show the counters, and the Block rows show the blocked clients (Status).

3

Adım 3 Remove the block (if necessary)

The Block rows are selected, Remove Blocks is clicked and confirmed; the block and the counter of the client are deleted together. Reset Counters only resets the counter; the existing block remains.

Verification

1TableTR7 side

The blocked clients are listed per policy.

ExpectedBlock rows

Method 5: L4 DDoS Live View → Quarantine Table

• How it works While they are in Quarantine mode, L4 DDoS Protection rules take the sources into the quarantine list of the route table; L4 DDoS Live View lists these sources with the remaining time and the rule that sent them to quarantine. The screen refreshes itself every 10 seconds.
• Where it is opened Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Live View
• Requirement At least one L4 DDoS rule in Quarantine mode (rules in Block mode do not write rows to this table)
• vService type Independent (all the traffic in the route table)

Step-by-Step Configuration

1

Adım 1 Open Live View

Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Live View tab is opened (access).

2

Adım 2 Read the quarantine table

The Quarantine table opens with the IP, Country, ASN, Quarantine end date (remaining time) and DOS/DDOS attack type columns.

3

Adım 3 Remove the source (if necessary)

With the icons in the address cell, the source is either only removed from quarantine, or added to the exemption list and removed (row operations); the operation is applied without asking for confirmation. Past quarantines are in the Quarantine History tab.

Verification

1TableTR7 side

The table is checked at the refresh after the removal.

ExpectedThe source's row is not in the list

In a cluster setup, removing a single source works only on the device that reports the row; if the source is in quarantine on both devices, the operation is performed on both rows.

Common Mistakes

• Assuming the table updates automatically. The Load Balancer, Bot/DDoS and AGS tables are refreshed with Refresh; only L4 DDoS Live View refreshes itself.
• Looking for the quarantine of different protections in one place. The Load Balancer Quarantine, Advanced CAPTCHA, Bot/DDoS, AGS and L4 DDoS tables are separate; a client is removed from the table of whichever protection it is in.
• Looking at the record of a single device in a cluster. Quarantine records are kept separately on each device; in the Load Balancer table, the device that holds the record appears in the Source column.
• Removing a legitimate user without fixing the cause. The same rule is triggered again; the threshold or the rule is corrected. For diagnosis: I am blocking legitimate users by mistake; how do I find out?

How it is done in the documentation

• Quarantine (Quarantine) Logs · Viewing
• Quarantine · Manual Removal from Quarantine
• Bot/DDoS · The Quarantine Table
• L4 DDoS Live View · The Quarantine Table

Related questions

• How does the Quarantine Action work; how long is a client that exceeds the threshold blocked?
• Can I do rate limiting (X requests per second per IP)?
• I am blocking legitimate users by mistake; how do I find out?
• How do I see sources that were quarantined in the past by L4 DDoS and why (Quarantine History)?