Block multiple IP's using panorama

[Himangi]

Hi,
I have been looking for a solution to block multiple IP's at the same time using pan-os integration. Is there any way where multiple IP's are given as input to block from firewall.

[TomYoung]

Hi @Himangi ,

Edit:  Oops!  My bad.  This is in the Cortex XSOAR forum. I keep forgetting to check that.

Edit 2:  Cortex XSOAR also does EDLs.  https://www.paloaltonetworks.com/blog/security-operations/playbook-of-the-week-automating-edl-manage.... You may need the TIM module.  https://www.paloaltonetworks.com/cortex/threat-intel-management

For the NGFW, you could put the IP addresses in an External Dynamic List.  https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/policy/use-an-external-dynamic-list-in-po...  You can configure the NGFW to check it every 5 minutes.  A commit is not required.  An external web server is required.  If you don't want to build your own, this one works great!  https://edlmanager.com/

Thanks,

Tom

[kreeves]

Hi Himangi,

If you are using user-id in your org you can also use ip-tags and Dynamic Groups.  ip-tags can get you a faster response that EDL but it may be more complex to implement.

an xsoar example

!pan-os-register-ip-tag tag="tag.test" IPs="1.1.1.1,2.2.2.2" persistent="false" timeout="5" using="PAN-INTEGRATION"