topic Re: DShield top 20 in General Topics

DShield top 20

jdprovine — Wed, 01 Apr 2015 14:13:02 GMT

Is anyone currently using this dshield top 20 list subscription? How well does it work/ Is anyone blocking inbound, outbound or both? What is the best way to configure it?

Re: DShield top 20

jdprovine — Thu, 02 Apr 2015 13:06:36 GMT

So has anyone used any dynamic block lists? If so how well did they work and what did they work on?

Re: DShield top 20

John_S — Thu, 02 Apr 2015 15:27:33 GMT

Like you, I was curious about using this and have configured a specific outbound rule which is currently allowing the traffic. Monitoring on that specific rule is currently showing outbound DNS, web-browsing and 360-safeguard-update traffic destined for the DShield top 20.

Re: DShield top 20

jdprovine — Thu, 02 Apr 2015 15:30:58 GMT

So you are currently using the DShield top 20 list on your outbound traffic and have found any benefits from it? Was it easy to configure? Why did you configure it as an outbound rule not and inbound rule? Do you have it as your top rule and have everything passing through it first?

Re: DShield top 20

John_S — Thu, 02 Apr 2015 15:53:32 GMT

It was easy to configure. I followed this document "Subscribing to the DShield Top 20 on a Palo Alto Networks Firewall - SANS Internet Storm Center" but used a https instead of http for obtaining list updates

This initial configuration is a cautious first step in implementing the blocklist. I've only done an initial outbound rule as I wanted to see how much traffic would be matched and what exact types would show up. Like the botnet reporting it is currently giving me some visibility into internal hosts that need to be looked at closer.

I've placed the rule near the top of the inside->outside rules after some of the other existing block rules but before the permit rules start. Based on how this initial testing turns out, I'll look at implementing inbound rules.

Re: DShield top 20

jdprovine — Thu, 02 Apr 2015 18:51:51 GMT

so you have downloaded the subscription for dshield which is a list of know bad ips to block any thing from the trust side to the untrusted side. You aren't allowing any of the internal traffic to query, contact or connect to anything on that list. Is this list dynamic? When do you plan to add a inbound list?

Re: DShield top 20

jdprovine — Mon, 13 Apr 2015 15:23:46 GMT

Have you ever used or heard of this list

https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt