topic Re: Dynamic External Lists for Hostnames in General Topics

Dynamic External Lists for Hostnames

Chris_Julio — Wed, 22 May 2019 17:11:45 GMT

Trying to figure out the best way to accomplish a task.

We have a "Suspicious" rule on our firewall that should be where we place hostnames for users that are observed to have questionable traffic.
This will be a dynamic list that will be updated by adding/removing hosts at any given time depending on security alerts
Since we use LDAP I know we can add the hosts directly to the rule

QUESTION: Has anyone used an External Dynamic List for hostnames to be added to the rule?

Thank you

Re: Dynamic External Lists for Hostnames

hshawn — Wed, 22 May 2019 20:03:09 GMT

It sounds like you have a few options here

1. Use Minemeld and point it to something you are using to host/build a list of hosts

2. Create a tag and dynamic group then add your objects and use the tag and build the policy using the group

3. Instead of using the user's source IP create a custom URL profile and add the nuisance sites into it then set that profile to block or continue

We are doing all of the above

Re: Dynamic External Lists for Hostnames

BPry — Thu, 23 May 2019 18:28:21 GMT

@Chris_Julio,

To the best of my knowledge a tag and a dynamic address-group is going to be the cleanest way of doing this; hostnames are not currently a valid option when using an EDL.