Can I block IP immediately using EBL?

ragonfly — Thu, 28 Jun 2018 04:59:07 GMT

Hello

I am using the Palo Alto Next Generation Firewall PA-3020 / PAN OS 7.02.

I use EBL to block IP.

After testing, it will take a long time for IP registered in the text file to be applied to the firewall.

Of course, i set "repeat" to 5 minutes in the EBL setting.

Also i checked that "repeat" was set to 5 minutes in the CLI.

However, when i check the EBL using the "request system external-list show" command in CLI, "Next Update Time" is displayed after 1 hour.

Is it possible for the firewall to block the IP as soon as it is entered in the text file?

please answer about my question.

Thank you!

Re: Can I block IP immediately using EBL?

BPry — Thu, 28 Jun 2018 14:56:05 GMT

@ragonfly,

It doesn't sound like the repeat frequency is actually taking effect. You can request a refresh manually by running 'request system external-list refresh'. You'll have to do the good old '?' after that statement to see what your options are, with 7.0 you wouldn't have to specify a type like those running higher versions and I don't have access to that old of a system to verify what the syntax is for you.

There were a few instances within 7.0 that had the firewall incorrectly inititating refresh jobs outside of what the refresh frequency was set, however it was specific to happening sooner than specified if memory serves correctly. Either way you really should update that thing, 7.0 is already EoL and there are quite a few security related fixes that you are missing that are present in later 7.0.* updates. If you are stuck on 7.0 for some reason at least update that thing to 7.0.19

topic Can I block IP immediately using EBL? in General Topics

Can I block IP immediately using EBL?

Re: Can I block IP immediately using EBL?