topic Re: Dynamic IP lists Known malicious Panorama Security rule not populating in Advanced Threat Prevention Discussions

Dynamic IP lists Known malicious Panorama Security rule not populating

Sec101 — Tue, 06 Mar 2018 16:02:19 GMT

I'm running into a problem where the "known malicious IP addresses" dynamic list isn't populating in panorama when to trying to add a security policy based on it, but is populating when I go to the local firewall and try to find it under the destination address. Has anyone ever run into this issue before?

Re: Dynamic IP lists Known malicious Panorama Security rule not populating

mivaldi — Tue, 06 Mar 2018 17:58:39 GMT

I have not, but if you think of it, it makes sense - most likely an optimization - Panorama doesn't need the list of IP's since it doesn't enforce Security Policies (traffic doesn't go through Panorama).

Re: Dynamic IP lists Known malicious Panorama Security rule not populating

JimMcGrady — Tue, 13 Mar 2018 07:59:13 GMT

Whats the URL for this list as provided by Palo Alto?

Re: Dynamic IP lists Known malicious Panorama Security rule not populating

OtakarKlier — Tue, 13 Mar 2018 21:12:45 GMT

Hello,

Are you referring to the Predefined list"

https://live.paloaltonetworks.com/t5/Featured-Articles/PAN-OS-8-0-IP-Block-List-Feeds/ta-p/129616

If yes, then its a hidden URL I believe.

Regards,

Re: Dynamic IP lists Known malicious Panorama Security rule not populating

mivaldi — Wed, 14 Mar 2018 22:27:02 GMT

The lists ship with a Dynamic Updates package.

I'm researching to find out exactly which one.

Re: Dynamic IP lists Known malicious Panorama Security rule not populating

Sec101 — Tue, 27 Mar 2018 14:31:26 GMT

Yes I am. I've even tried to manually copy and paste it into panorama for the destination address--like a custom EDL would show up, but panorama still doesn't recognize it.

Re: Dynamic IP lists Known malicious Panorama Security rule not populating

mivaldi — Mon, 09 Apr 2018 17:02:42 GMT

The list ships with the Antivirus package. Make sure you deploy the Antivirus package to Panorama so that it has knowledge of the lists.

Re: Dynamic IP lists Known malicious Panorama Security rule not populating

BrandonWright — Fri, 12 Oct 2018 18:34:00 GMT

I found a solution to this. Apparently on Panorama, you have to reference by the source name not the EDL name. For 'Palo Alto Networks - Known malicious IP addresses' use 'panw-known-ip-list'

For 'Palo Alto Networks -High risk IP addresses' use 'panw-highrisk-ip-list'.

Re: Dynamic IP lists Known malicious Panorama Security rule not populating

mivaldi — Fri, 12 Oct 2018 18:37:58 GMT

Thanks Brandon, commenting on my own post:

The reason why that may be wrong is that you should be able to define EDL exceptions in Panorama.

Re: Dynamic IP lists Known malicious Panorama Security rule not populating

rsukhnanan — Sat, 03 Aug 2019 22:27:50 GMT

I know this is kinda old but the solution worked for me. So Thanks! 🙂

Re: Dynamic IP lists Known malicious Panorama Security rule not populating

ChrisVee — Wed, 20 Jul 2022 00:35:37 GMT

Still valid in 10.1.x Please fix or provide a KB with listing of all predefined ip listing references

panw-bulletproof-ip-list
panw-torexit-ip-list
panw-known-ip-list
panw-highrisk-ip-list

Re: Dynamic IP lists Known malicious Panorama Security rule not populating

rokib.cse05 — Wed, 29 Mar 2023 05:21:14 GMT

For populating 'Known malicious IP addresses/High Risk IP Address etc' in panorama, you need to first update panorama Dynamic Update from Panorama->Dynamic Updates for panorama. Download and install the update for Antivirus, Apps and Threat and wildfire. After the update completed, you can see the 'Known malicious IP addresses/High Risk IP Address etc' list is populated in panorama Objects->External Dynamic Lists.