topic Re: Block traffic to ip addresses in General Topics

Block traffic to ip addresses

akumar — Wed, 27 Mar 2013 20:11:13 GMT

How do you block traffic going directly to ip addresses?

Re: Block traffic to ip addresses

Retired Member — Wed, 27 Mar 2013 20:18:25 GMT

What do you mean by directly ip addresses

browsing domains by ip ?

or there is an ip list ?

Re: Block traffic to ip addresses

wesa — Wed, 27 Mar 2013 20:24:08 GMT

So these Ips don't resolve to host name?

Re: Block traffic to ip addresses

akumar — Wed, 27 Mar 2013 20:46:29 GMT

A lot of poorly intended code (read malware) are designed to go directly to IP addresses that may or may not resolve to nicely constructed dns names. In my experience, these more most likely to be malicious CNC hosts etc. The best practice here is to deny http/ssl to ip addresses.

Blue Coat provides a way to create a filter of the kind http(s)://\d+\.\d+\.\d+\.\d+, but this does not appear to be possible in PA.

Apologies for not clarifying this initially. I thought this would be a common question.

Ash

Re: Block traffic to ip addresses

mikand — Thu, 28 Mar 2013 21:29:13 GMT

I think you can do this yourself with a custom url filter.

Otherwise the "proper" solution is to create a custom blacklist rule in front of the other rules (maybe put a whitelist rule in front of the blacklist one :smileysilly:) where you block bad dstip's.

PANDB should be able to be more granular than the Brightcloud db, but I dunno if the PANDB includes ip addresses as "hostnames" or not - parhaps someone from PA (who is lurking this forum) could answer that?

Re: Block traffic to ip addresses

dyang — Thu, 28 Mar 2013 22:24:32 GMT

I think I heard my name

PAN-DB does include IP address categorization, though the majority of entries are made up of URLs. While a lot of malware does go directly to IP addresses, we've also noticed that many streaming media applications behave similarly (eg BBC iPlayer). If you would like to safely enable these applications, use App-ID to do so.

--Doris

Re: Block traffic to ip addresses

akumar — Fri, 29 Mar 2013 15:51:45 GMT

I have not considered moving to PAN-DB from the Brightcloud system. Too many unanswered questions such as quality of categorization, performance etc.

We already permit specific applications upfront.

What we would like to do is block all other traffic to IP addresses and deal with specific exceptions as a safer approach.

Ash

Re: Block traffic to ip addresses

mikand — Fri, 29 Mar 2013 21:33:13 GMT

Then it should work if you only specify which categories you wish to allow - sites/ipaddresses not part of this whitelist will then be blocked and you get the effect you seem to be asking for.