topic Block Dynamic Domain from Security Rulebase in General Topics

Block Dynamic Domain from Security Rulebase

Mohammed_Yasin — Tue, 23 Jun 2020 08:33:58 GMT

Already the specified Malicious URL getting a block from URL Filtering and detected in Threat Prevention with action.

it’s a dynamic FQDN/IP that has to block from the security rule base too, but the does not want to add each IP to block as he received every time.

looking for a solution where the dynamic IP can be blocked from the firewall itself so that adding the dynamic IPs or FQDN can be avoided.

apart from EDL there any other option to block the dynamic IP and URL can be block.

As the URL receives example.. www.abc.com / www.abc.2.com / www.2.abc.com / www.jhs.abc.com / www.mem1.abc.com with

dynamic IPs, only common is abc.com rest of are keep on change.

Re: Block Dynamic Domain from Security Rulebase

BPry — Wed, 24 Jun 2020 04:46:02 GMT

@Mohammed_Yasin,

Depending on what the domain is, a custom vulnerability signature could work.

Re: Block Dynamic Domain from Security Rulebase

Mohammed_Yasin — Wed, 24 Jun 2020 07:55:53 GMT

Thanks for the update.

It's a public domain website. and already firewall see has a vulnerability for this site.

Re: Block Dynamic Domain from Security Rulebase

OtakarKlier — Wed, 24 Jun 2020 20:47:43 GMT

Hello,

If the URL filter is flagging it and blocking it, why would you want to block the IP as well? Most sites are hosted by a provider and can we attached to many different sites. Just follow the best practice for URL filtering and DNS sinkhole and let the firewall send telemetry back to PAN so they can update their data bases.

Hope that makes sense.

Re: Block Dynamic Domain from Security Rulebase

pawelzwierz — Thu, 25 Jun 2020 11:55:10 GMT

DNS Security feature can detect similar domain