topic Re: Blocking lists of IPs in General Topics

Blocking lists of IPs

sconley — Tue, 28 Aug 2012 13:51:47 GMT

I'd like to block a list of IP addresses based on the ZeuS IP Blocklist. What is the best/preferred method for doing this on the Palo Alto? Thanks

Re: Blocking lists of IPs

holmesw — Tue, 28 Aug 2012 20:11:07 GMT

You can partially automate this with a small bash script that reads the ZeuS IP blocklist and creates the CLI commands to modify the firewall.

#!/bin/bash

seq=1

today=$(date +%m/%d/%Y)

echo "set cli scripting-mode on"

echo "configure"

description="zeus $today"

for ip in $(egrep '^[1-9]' zeus.txt); do

name="zeus_${seq}"

echo "set address $name description \"$description\" ip-netmask $ip"

echo "set address-group bad_guys [ $name ]"

seq=$(($seq + 1))

done

echo " "

echo "commit"

echo "save config"

With a shortened zeus file, the output is:

set cli scripting-mode on

configure

set address zeus_1 description "zeus 08/28/2012" ip-netmask 103.11.74.6

set address-group bad_guys [ zeus_1 ]

set address zeus_2 description "zeus 08/28/2012" ip-netmask 108.163.232.202

set address-group bad_guys [ zeus_2 ]

set address zeus_3 description "zeus 08/28/2012" ip-netmask 108.163.247.74

set address-group bad_guys [ zeus_3 ]

set address zeus_4 description "zeus 08/28/2012" ip-netmask 109.127.8.242

set address-group bad_guys [ zeus_4 ]

set address zeus_5 description "zeus 08/28/2012" ip-netmask 109.127.8.246

set address-group bad_guys [ zeus_5 ]

set address zeus_6 description "zeus 08/28/2012" ip-netmask 109.169.58.188

set address-group bad_guys [ zeus_6 ]

set address zeus_7 description "zeus 08/28/2012" ip-netmask 109.202.98.26

set address-group bad_guys [ zeus_7 ]

commit

save config

Manually enter "set cli scripting-mode on" so that you can easily cut-n-paste the script output into the PA command line. Then, cut-n-paste the everything but the commit and save commands. If you do not get errors, perform the commit and save. This does require the presence of existing security policies that block traffic to and from the group bad_guys.

This can be further automated using Expect or the API once you are confident things are working. Note there is (or was) a limit of 500 objects in a group. But, you can use groups of groups to get around that. The scripting does get more complex. At that point, a better scripting language is in order.

Re: Blocking lists of IPs

yesitisme_007 — Tue, 19 Feb 2013 17:33:37 GMT

PAN-OS 5.0 has a new feature called "Dynamic Block Lists". We have not yet tested the functionality but it looks like the answer to your need.

Re: Blocking lists of IPs

mbutt — Tue, 19 Feb 2013 19:26:37 GMT

Here are some details on dynamic Block list

Use the Dynamic Block Lists page to create an address object based on an imported list of IP addresses. The source of the list must be a text file and must be located on a web server. You can set the Repeat option to automatically update the list on the device hourly, daily, weekly, or monthly. After creating a dynamic block list object, you can then use the address object in the source and destination fields for security policies. Each imported list can contain up to 5,000 IP addresses (IPv4 and/or IPv6), IP ranges, or subnets.

The list must contain one IP address, range, or subnet per line, for example:

“192.168.80.150/32” indicates one address, and “192.168.80.0/24” indicates all addresses from 192.168.80.0 through 192.168.80.255.

Example:

“2001:db8:123:1::1” or “2001:db8:123:1::/64”

IP Range:

To specify an address range, select IP Range, and enter a range of addresses. The format is:

ip_address–ip_address

where each address can be IPv4 or IPv6.

Example:

“2001:db8:123:1::1 - 2001:db8:123:1::22”

Field	Description
Name	Enter a name to identify the Dynamic Block List (up to 32 characters). This name will appear when selecting the source or destination in a policy.
Description	Enter a description for the block list (up to 255 characters).
Source	Enter an HTTP or HTTPS URL path that contains the text file. For example, http:\\1.1.1.1\myfile.txt. You can also enter a UNC server path.
Repeat	Specify the frequency in which the list should be imported. You can choose hourly, daily, weekly, or monthly. At the specified interval, the list will be imported into the configuration. A full commit is not needed for this type of update to occur.
Test Source URL	Test that the source URL or server path is available.

Re: Blocking lists of IPs

mbutt — Tue, 19 Feb 2013 19:33:06 GMT

Here is another Link for Dynamic Block Lists and Spamhaus

https://live.paloaltonetworks.com/docs/DOC-4146

Hopefully this helps.

Thank you

Numan

Re: Blocking lists of IPs

sconley — Thu, 21 Feb 2013 12:51:17 GMT

Thanks everyone for the responses. We've been actively using the dynamic block list feature since the 5.0 release (I guess I forgot to update this thread). We've been working with support on 1 issue we've been seeing when using the Spamhaus list.