topic Re: External Feed URL Configuration in General Topics

External Feed URL Configuration

Vikashh — Mon, 06 Apr 2020 04:43:10 GMT

hello all,

I am looking for configuring my own external feed URL for blocking malicious/blacklisted domains/IP addresses. There are lots for external public feed URLs which includes blacklisted IPs/domains but somehow we do not have control on it. So i am looking to configure something which will be in my control. This is something that i can modify at any point of time.

Need your inputs on configuration part.

Re: External Feed URL Configuration

SutareMayur — Mon, 06 Apr 2020 06:23:52 GMT

Hello @Vikashh ,

You can configure simple IIS based web page on internal windows server which will be reachable to all your Palo alto gateways. The IIS page can configured on any port. Webpage will include list of IP addresses/domains that you want to make a part of the list. Once WebPage is ready, you can check accessing weburl from your LAN system. If it is properly configured, you should see contents of webpage.

Once WebPage is opening properly, configure it as external feed url under EDL. Make sure it is properly configured. For example, you have configured web page on port 8080 and it is on server 10.10.10.10 then feed url will be like http://10.10.10.10:8080 etc.

For IIS configuration part, you can refer below video link.

https://www.youtube.com/watch?v=VMyMag9_vmc

Hope it works for you!

Mayur

Re: External Feed URL Configuration

Vikashh — Mon, 06 Apr 2020 11:04:53 GMT

Thank you!

I will follow steps and configure same. Just once question, in any case if my windows server goes down then all the IP/domains database flushes from gateway or how it is? If it gets flush then it will be disater.

Please give some inputs on this.

Re: External Feed URL Configuration

SutareMayur — Mon, 06 Apr 2020 11:55:36 GMT

@Vikashh ,

Whatever data is already synced with gateway, it will be as it is with it in any situation till next sync with the feed url. So if your windows server goes down, then data that was sync from feed url before server went down will be with firewall. And Firewall will take actions on it as per policy configured.

Mayur

Re: External Feed URL Configuration

Vikashh — Tue, 07 Apr 2020 05:31:17 GMT

Ok then, thats Great !

I have configured web page as per your earlier mail and attached it to the gateway. I was able to see IP details locally on gateway. So far so good!

Thank you for your help!

Re: External Feed URL Configuration

SutareMayur — Tue, 07 Apr 2020 06:07:39 GMT

@VikashhCan you please mark this question as solved please?

Mayur