topic Re: Blocking external IP addresses and blacklists in Advanced Threat Prevention Discussions

Blocking external IP addresses and blacklists

lukerath — Mon, 30 Oct 2017 10:58:39 GMT

Hi,

I have some questions regarding the PAN-OS and blocking IP addresses.

We are getting daily emails with lists of IP's that are port scanning and probing th FW. The customer wants all these addresses blocked. For example over the last 2 weeks I have around 60 addresses to add. At the minute the process is to add each IP under objects > Addresses and then add the address object in to an address group object that blocks these addresses.

Is there a better way of doing this? I have found an article on External Dynamic Lists and using an interal web server which looks like a good option.

The other question I have is when I put these addresses in to a blacklist checker most of the come up on external blacklists. Is there a way of using these blacklists to block the traffic instead of keeping our own list?

Thanks in advance,

Luke

Re: Blocking external IP addresses and blacklists

AndyYerger — Thu, 07 Dec 2017 17:26:31 GMT

Question what pan os version are you using . I'm on 8.0.x and it has a built in External Block list that you can add to your Security rules.

Re: Blocking external IP addresses and blacklists

OtakarKlier — Mon, 18 Dec 2017 23:59:45 GMT

Hello,

Here is a good video for v7.1.

https://live.paloaltonetworks.com/t5/Tutorials/PAN-OS-7-1-URL-Filtering-Dynamic-Block-List-External-Block-List/ta-p/74098/jump-to/first-unread-message

And here is a document for v8

https://live.paloaltonetworks.com/t5/PAN-OS-8-0-Articles/PAN-OS-8-0-IP-Block-List-Feeds/ta-p/129616/jump-to/first-unread-message

Cheers!

Re: Blocking external IP addresses and blacklists

Ricardo-GTZ — Mon, 22 Feb 2021 19:00:19 GMT

This will show you how to blacklist IP addresses automatically and place them in a firewall rule autoamtically.

https://www.smartcloudcomputing.net/2021/02/22/how-to-automatically-blacklist-an-attackers-ip-on-palo-alto/

Re: Blocking external IP addresses and blacklists

RGPT-asmith — Fri, 09 Apr 2021 14:52:55 GMT

@ OtakarKlier

I am Access Denied to both of those links.

Re: Blocking external IP addresses and blacklists

OtakarKlier — Fri, 09 Apr 2021 15:11:59 GMT

Hello,

I would say just go with the several built in lists. Stay with more behavioral based approaches along with a secure DNS provider.

https://live.paloaltonetworks.com/t5/learning-articles/working-with-external-block-list-ebl-formats-and-limitations/ta-p/58795

Regards,

Re: Blocking external IP addresses and blacklists

RGPT-asmith — Fri, 09 Apr 2021 15:22:52 GMT

A bit frustrating when looking for help and all the links come up like this. Including this latest one.

Re: Blocking external IP addresses and blacklists

OtakarKlier — Fri, 09 Apr 2021 15:24:00 GMT

Agreed. Hope you got the info you needed.

Re: Blocking external IP addresses and blacklists

LukeRath — Fri, 09 Apr 2021 15:37:43 GMT

Have you tried MineMeld?

Re: Blocking external IP addresses and blacklists

Ricardo-GTZ — Sat, 10 Apr 2021 12:55:41 GMT

That is a live community message,

Here is the URL https://www.smartcloudcomputing.net/2021/02/22/how-to-automatically-blacklist-an-attackers-ip-on-palo-alto/

Re: Blocking external IP addresses and blacklists

Kobiher — Wed, 01 Dec 2021 07:33:36 GMT

unfortunately - those links don't work anymore, so there is no point in trying to see them...

Re: Blocking external IP addresses and blacklists

Kobiher — Thu, 07 Sep 2023 16:32:01 GMT

so I did the next best thing and googled it...

https://www.google.com/search?q=how-to-automatically-blacklist-an-attackers-ip-on-palo-alto&rlz=1C1GCEB_enHU1040HU1041&oq=how-to-automatically-blacklist-an-attackers-ip-on-palo-alto&gs_lcrp=EgZjaHJvbWUyBggAEEUYOdIBCDc2MThqMGo3qAIAsAIA&sourceid=chrome&ie=UTF-8

Thank you for the likes 🙂