Block traffic to ip addresses

cancel
Showing results for 
Search instead for 
Did you mean: 

Block traffic to ip addresses

Not applicable

How do you block traffic going directly to ip addresses?

7 REPLIES 7

L6 Presenter

What do you mean by directly ip addresses

browsing domains by ip ?

or there is an ip list ?

Not applicable

So these Ips don't resolve to host name?

A lot of poorly intended code (read malware) are designed to go directly to IP addresses that may or may not resolve to nicely constructed dns names. In my experience, these more most likely to be malicious CNC hosts etc. The best practice here is to deny http/ssl to ip addresses.

Blue Coat provides a way to create a filter of the kind http(s)://\d+\.\d+\.\d+\.\d+, but this does not appear to be possible in PA.

Apologies for not clarifying this initially. I thought this would be a common question.

Ash

I think you can do this yourself with a custom url filter.

Otherwise the "proper" solution is to create a custom blacklist rule in front of the other rules (maybe put a whitelist rule in front of the blacklist one :smileysilly:) where you block bad dstip's.

PANDB should be able to be more granular than the Brightcloud db, but I dunno if the PANDB includes ip addresses as "hostnames" or not - parhaps someone from PA (who is lurking this forum) could answer that?

I think I heard my name  :smileywink:

PAN-DB does include IP address categorization, though the majority of entries are made up of URLs.  While a lot of malware does go directly to IP addresses, we've also noticed that many streaming media applications behave similarly (eg BBC iPlayer).  If you would like to safely enable these applications, use App-ID to do so.

--Doris

I have not considered moving to PAN-DB from the Brightcloud system. Too many unanswered questions such as quality of categorization, performance etc.

We already permit specific applications upfront.

What we would like to do is block all other traffic to IP addresses and deal with specific exceptions as a safer approach.

Ash

Then it should work if you only specify which categories you wish to allow - sites/ipaddresses not part of this whitelist will then be blocked and you get the effect you seem to be asking for.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!