topic Re: Adding Malicious IPs on security list manually on FWs which don't have threat protection license in Next-Generation Firewall Discussions

Adding Malicious IPs on security list manually on FWs which don't have threat protection license

shafi021 — Thu, 03 Nov 2022 19:13:24 GMT

Hi Guys,

We have two firewalls with Threat prevention license and few other palo firewalls without threat prevention license.

I have a requirement to create security rules to block malicious IPs. I can do this easily on FW which has Dynamic external list of malicious IPs because of license but I can't do same thing on other FWs which don't have threat prevention license.

I can get the malicious IPs from FWs which has threat prevention license and can add them manually to block on FW without license.

I check and there are some around 3500+ malicious and 4000+ high risk IPs in Dynamic list.

Can anyone suggest me how can I add these IPs in security list easily? It will be very difficult to create address objects for these IPs.

Is there any easy way, I can just copy past these IPs and add them in security list ?

Also, I know these IPs are dynamic and list's IPs can change anytime but my management want to do them anyway.

Please provide any suggestion for this issue. Thank you so much.

Re: Adding Malicious IPs on security list manually on FWs which don't have threat protection license

shafi021 — Thu, 03 Nov 2022 19:16:23 GMT

@BPry @OwenFuller do you have any suggestions on this ? Your help will be appreciated. Thank you

Re: Adding Malicious IPs on security list manually on FWs which don't have threat protection license

OwenFuller — Thu, 03 Nov 2022 21:36:57 GMT

Getting a Threat Prevention license and using an EDL would be the obvious solution. However, you could also create a "Malicious-IPs" address group and assign addresses to it via the CLI using set commands. This might save you some time.
How to Add and Verify Address Objects to Address Group and Secu... - Knowledge Base - Palo Alto Networks