topic Absolute domain ending in .txt in Next-Generation Firewall Discussions

Absolute domain ending in .txt

MGMGMG — Fri, 16 Dec 2022 07:02:59 GMT

HI all,

i received from an external provider a .txt list to block in my palo alto.

The list is not exactly a file ,is an absolute domain,i mean is like www.test.com/blacklist/domain.list.txt.

This will be a dynamic list,so is there some way to save this domain as object in palo alto,adding to a policy,and palo alto will update automatically as far as the provider update the .txt list?

I tried to save as FQDN ,but can't resolve it,so can't be added.

I tried as well as Dynamic address group,but as i can't save the domain as normal object i can't use it as "match criteria".

Hope is clear.

Thanks in advance.

Re: Absolute domain ending in .txt

Arnesh — Fri, 16 Dec 2022 09:55:26 GMT

Hi @MGMGMG

Perhaps, the EDL can solve your problem. It can fetch the URLs, IPs and then can be used on the firewall in security policies or as a URL-category for block or allow traffic.

Regards

Re: Absolute domain ending in .txt

W_Rafalski — Fri, 16 Dec 2022 10:14:01 GMT

Hello,

@Arnesh is right, External Dynamic Lists work exactly as You need.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/external-dynamic-list

Going further, there is even nice tool called MineMeld which can collect feeds and prepare special lists for Your devices.

https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/minemeld

Re: Absolute domain ending in .txt

MGMGMG — Fri, 16 Dec 2022 10:24:00 GMT

Hi Arnesh,

just tried your tip and working exactly as i needed.

Thanks W_Rafalski,looked at the link and sounds interesting.

Thank for support and regards.