topic Re: External Dynamic List exceptions in General Topics

External Dynamic List exceptions

Laurent_Dormond — Thu, 26 Apr 2018 08:53:04 GMT

Hello,

We have recently upgraded our FW to PanOS 8.x (currently running 8.0.8) and we want to use the newly added feature that enable to add exceptions in External Dynamic List.

However it doesn't seem to work since the configured IP we put in exceptions (in a IP list) are still blocked by our policy.

Did you try this and does it work for you ?

Re: External Dynamic List exceptions

BPry — Thu, 26 Apr 2018 13:09:15 GMT

@Laurent_Dormond,

I don't usually use this feature as I find it easier to simply do this directly on MineMeld, but I just tested it on one of my firewalls and it seems to be functioning correctly. Just wondering if you remembered to actually commit the change for it to take effect, as it does add an exception-list entry into the configuration.

Re: External Dynamic List exceptions

Laurent_Dormond — Thu, 26 Apr 2018 13:28:00 GMT

Thanks for your answer.

We are not using Minemeld yet but we are looking at it.

I did the commit of course also the exception has been added to the config.

Re: External Dynamic List exceptions

BPry — Thu, 26 Apr 2018 13:48:25 GMT

@Laurent_Dormond,

Odd. With the exception in place I would suspect that this would allow the traffic as it should, so you might want to open a TAC case if this is something that you actually need to function so they can take a look at your particular device to see why it may not be working.

Personally I would really look at simply setting up the lists in question through minemeld and going that route. It's easy to configure and is generally more customizable and allows a lot of automation to take place.