it depend on the configuration on BFM and the csf
if you setup the BFM to block ip in 5 attempt and csf to 3 attempt then after 3 attempt the csf block that ip otherwise if csf not ruuning then after 5 attempt the BFM bloack that ip
what you want to achieve by this
after this answer i can tell you more