Limitations and Precautions for Blacklist

The following table lists the support of blacklist functions by various models.

**Table 1** Support of blacklist functions
Blacklist Type		USG6510E/6510E-POE, USG6530E, USG6515E/6550E/6560E/6580E, and USG6525E/6555E/6565E/6575E-B/6585E/6605E-B	USG6610E/6620E, USG6615E/6625E, USG6630E/6650E, USG6635E/6655E, USG6680E, and USG6712E/6716E
Static blacklist	CPU blacklist	All models support manual blacklist creation on CPUs.	All models support manual blacklist creation on CPUs. IPv4 blacklists are automatically synchronized to the NP chips. IPv6 blacklists cannot be automatically synchronized to the NP chips.
Static blacklist	Hardware chip blacklist	All models support blacklist creation on NP chips.	No models support hardware chip blacklists.
Dynamic blacklist		Dynamic blacklists are delivered to CPUs.	Dynamic blacklists are delivered to CPUs and NP chips. IPv6 dynamic blacklists are not delivered to the NP chips.

The blacklist function is not license-controlled.

The CPU supports blacklists of IPv4 and IPv6 types, and the hardware chip supports blacklists of only the IPv4 type.
On the web UI, you can create and view blacklists of only the CPU type but not the hardware chip type.
The blacklist on the hardware chip takes effect only for traffic on the service interface but not on the management interface.
During configuration restoration after the device restarts, blacklist entries on the hardware chip are not restored immediately. Before the entries are restored, traffic matching the entries cannot be blocked.
For the USG6510E/6510E-POE, USG6530E, USG6515E/6550E/6560E/6580E, and USG6525E/6555E/6565E/6575E-B/6585E/6605E-B, when both the hardware chip blacklist and static whitelist are created, traffic is preferentially matched against the hardware chip blacklist. If the traffic matches the hardware chip blacklist, the traffic is discarded, without being matched against the whitelist.