topic Automatic IP block-list PAN 8.0 in Advanced Threat Prevention Discussions

Automatic IP block-list PAN 8.0

ebenditt1 — Tue, 10 Apr 2018 15:19:33 GMT

Hello all,

I am wondering if there is any way to let's say block the IP address from a source for a set period of time. An example of this could be, we are being attack, same IP address hitting our firewall a 100 times in 3 minutes, It is being reported as "code execution vulnerability." Now the action is dropped, but the IP address could be running some other exploit at the same time, and not recognized by the firewall as such or maybe it is. I am looking for a way to automate a process by which we can setup some kind of rule to block that IP address, of the source, for a set period of time.

Basic I am looking for a way to say look I am being hit by this IP on multiple ports and they are for different services all with let say 2 minutes. I want to be able to automatically block that source for let say 5-10 minutes to see if it happens again and if it does the add it to the external block-list.

Any assistance would be greatly appreciated.

Re: Automatic IP block-list PAN 8.0

mivaldi — Tue, 10 Apr 2018 15:28:24 GMT

You can do this by configuring a Threat Exception and changing the Action to block-ip.

You can define the block time for the block-ip action.

Here are a couple KB's on this subject:

https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/How-to-Block-A-Threat-For-a-Specific-Time-Interval/tac-p/149397#M240

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat-prevention/customize-the-action-and-trigger-conditions-for-a-brute-force-signature.html

Re: Automatic IP block-list PAN 8.0

ACortes — Wed, 11 Apr 2018 07:23:06 GMT

With Block-IP you can drop traffic for a defined period, between 1 and 3600 seconds. Take care when apply because legitimate sources could also be blocked.

Re: Automatic IP block-list PAN 8.0

Ricardo-GTZ — Mon, 22 Feb 2021 18:58:25 GMT

This maybe of use to you.

check it out.

https://www.smartcloudcomputing.net/2021/02/22/how-to-automatically-blacklist-an-attackers-ip-on-palo-alto/