topic Re: Dynamic Block List Site in General Topics

Dynamic Block List Site

das — Thu, 21 Mar 2013 14:46:46 GMT

Is there a list of known bad IP addresses? I would like to include a dynamic block list in my policy but I don't have a list of known bad IP addresses. Does Palo Alto have a canned list of IPs that I can reference to insert into my policy?

Re: Dynamic Block List Site

wesa — Thu, 21 Mar 2013 15:09:48 GMT

Paloalto doesn't have list of bad ips database. you may use spamhaus.org to obtain that information but that would be a lot of work for you. I think the best practice for you is to focus on specific bad ips that are hitting your firewall and create a policy based on that

Re: Dynamic Block List Site

gafrol — Thu, 21 Mar 2013 15:24:20 GMT

I filed a feature request long time ago to have a feature known as Reputation based (DNS/IP) block list which works very well with one of the top IPS vendors in the market.

Until now nothing has been implemented so far, although BrightCloud already has a Reputation based Database which could be a source for this feature

http://brightcloud.com/toc/webreputation.php

Re: Dynamic Block List Site

mikand — Thu, 21 Mar 2013 21:32:21 GMT

Hopefully this should be doable with PANDB or similar.

As a workaround you can download bad ip's like http://support.clean-mx.de/clean-mx/viruses.php among other places, create a txt-file with the bad ip's and use the dynamic rule stuff in PANOS 5.x (I think it was introduced) where the firewall every 5 minutes (or so depending on setting) will download this ip-list from your server and put this dynamically in a group which then is used to either allow or deny traffic.

Re: Dynamic Block List Site

dyang — Thu, 21 Mar 2013 22:11:28 GMT

Hi everyone,

Thanks for your comments - as mentioned, Palo Alto Networks does not have a downloadable list of bad/malicious IP addresses for people to import. Instead, as our threat team identifies malware, they automatically take any URL or IP associated with that threat and will include it as part of the PAN-DB URL filtering database.

There are certainly a number of 3rd party vendors such as spamhaus.org that provide downloadable lists that you are welcome to use with the dynamic block list feature.

--Doris

Re: Dynamic Block List Site

jkim2 — Sat, 27 Apr 2013 03:00:21 GMT

Use at your own risk but below are some sites to test the dynamic block, its not a long list but its a simple txt

Make sure you create a service route for the DNS , then select the dynamic block object as destination and test with ping before & after.

http://www.ciarmy.com/list/ci-badguys.txt

http://www.malwaredomainlist.com/hostslist/ip.txt

Re: Dynamic Block List Site

Mike_Walsh — Thu, 15 Aug 2013 13:49:45 GMT

Doris,

I am new to Palo Alto. Getting asked this same question about IP Reputation lists. I assume that your reply would still be the same today. Need to get back to the customer and just want to confirm.

Thanks...

Mike