topic Re: RE: MineMeld + Palo Alto Networks on Dynamic Block List in General Topics

MineMeld + Palo Alto Networks on Dynamic Block List

dkoh — Wed, 20 Jul 2016 17:34:02 GMT

Is there anyone able to share on how to configure minemeld nodes to automate resolving/capturing the “*.google.com.*” dynamic IP address, so I could integrate with palo alto networks dynamic Block list feature to identify most of the google.com IP addresses.

I saw google.GCENetblocks and google.netBlocks in minemeld, but wondering if this cover “*.google.com.*”. I will wish to know how to add a customize minemeld node on youtude if possible. For example on http/https “*.youtube.com.*”.

Your help is very much appreciated. Thanks a lot.

RE: MineMeld + Palo Alto Networks on Dynamic Block List

lmori — Wed, 20 Jul 2016 17:34:48 GMT

Hi,

google.netBlocks and google.GCENetBlocks retrieve the list of IP addresses used by Google services and Google GCE using DNS queries. Ref:

https://support.google.com/a/answer/60764?hl=en

https://cloud.google.com/compute/docs/faq#where_can_i_find_short_product_name_ip_ranges

Is this your goal ?

Thanks,

luigi

Re: RE: MineMeld + Palo Alto Networks on Dynamic Block List

dkoh — Tue, 02 Aug 2016 07:29:29 GMT

Hi luigi,

Thanks for the information, yes this is on google. But how about Youtube.com, anyway we can set up a node on Youtube.com global list in the ProtoType?

Please let me know if this is possible in the minemeld.

Thanks

Darren Koh

+65 91790713

Re: RE: MineMeld + Palo Alto Networks on Dynamic Block List

lmori — Tue, 02 Aug 2016 11:39:57 GMT

Hi Darren,

I haven't found a way to obtain all the IPs used by Youtube. Wouldn't be better to control access using App-ID ? Or you need IPs ?

Re: RE: MineMeld + Palo Alto Networks on Dynamic Block List

dkoh — Mon, 08 Aug 2016 09:36:41 GMT

Hi Luigi,

Customer would want to use PBF policy to route all Youtube Taffic to direct traffic to a specific Egress interface on the firewall.

The problem is our PBF policy dont have all APP-ID signature in it, such as Youtube, Facebook and etc.

Thanks

Darren Koh

Re: RE: MineMeld + Palo Alto Networks on Dynamic Block List

lmori — Wed, 10 Aug 2016 12:47:27 GMT

Hi Darren,

understood. The problem is I can't find a good way to isolate the IPs used by Youtube from those used by other Google Services.

Do you have an idea on how to do that ?

Thanks,

Luigi

Re: RE: MineMeld + Palo Alto Networks on Dynamic Block List

dkoh — Thu, 11 Aug 2016 06:58:30 GMT

Hi Luigi,

I got a solution on this but it is a bit of work to do, we were need to create a new miner and proyotype as shown below:

https://github.com/PaloAltoNetworks/minemeld/wiki/How-To-Write-a-Simple-Miner#the-prototype

Hope this make sense to you.

Thanks

Darren koh

Re: RE: MineMeld + Palo Alto Networks on Dynamic Block List

lmori — Fri, 12 Aug 2016 14:41:01 GMT

Hi Darren,

writing a Miner would be definitely possible, but the example shown in the github doc is for retrieving a list of URLs associated with a YouTube channel. You can't use those in a PBF. Would a list of URLs be enough ?

Luigi

Re: RE: MineMeld + Palo Alto Networks on Dynamic Block List

dkoh — Thu, 01 Sep 2016 03:09:01 GMT

Hi Luigi,

URLs will not be enough i was thinking of creating a miner/prototype to indicate all the youtube.com IP address in the miner to to make the Dynamic list works better. you have any insight on how this can works?

Thanks

Darren koh