topic Re: Importing list of Blocked IP's and URL's into EDL in General Topics

Importing list of Blocked IP's and URL's into EDL

D.Callahan — Thu, 19 Dec 2024 15:54:17 GMT

Hi,

I want to be able to quickly blacklist a bunch of URL's and IP's from internal uers going out to the internet.

What is the best way to achieve this? Would I just place them all in a file text file, and just import them to a custom External Dynamic List?

Thanks for the help in advanced.

Re: Importing list of Blocked IP's and URL's into EDL

OtakarKlier — Thu, 19 Dec 2024 18:50:23 GMT

lo,

If you really want to setup your own:

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/configure-the-firewall-to-access-an-external-dynamic-list-from-the-edl-hosting-service/create-an-external-dynamic-list-using-the-edl-hosting-service

However what I typically do is configure the URL filtering to block the not so good sites as well as advertising. Then also use the built-in EDL lists PAN already has. These are dynamically updated and you can test them by attempting to go to those sites, etc.

Rolling your own is like the whack-a-mole game and its not much fun.

Regards,

Re: Importing list of Blocked IP's and URL's into EDL

D.Callahan — Fri, 20 Dec 2024 13:57:49 GMT

Thank you for the reply. I will try to do that and see how everything works.

Re: Importing list of Blocked IP's and URL's into EDL

BPry — Mon, 23 Dec 2024 16:20:35 GMT

@D.Callahan,

I would personally have an EDL for blocked domains and blocked IPs already configured on the firewall so that they can be utilized when you actually need to, not as a replacement for the built-in lists and categorization that @OtakarKlier mentioned but simply in addition to.

This will allow you to quickly block a domain or IP address when needed/requested without actually having to force a commit on the firewall, as the EDL will be updated on whatever schedule you have configured and can be refreshed manually on the firewall outside of that schedule without triggering an actual configuration commit.