Block traffic to ip addresses

[akumar]

How do you block traffic going directly to ip addresses?

[panos]

What do you mean by directly ip addresses

browsing domains by ip ?

or there is an ip list ?

[wesa]

So these Ips don't resolve to host name?

[akumar]

A lot of poorly intended code (read malware) are designed to go directly to IP addresses that may or may not resolve to nicely constructed dns names. In my experience, these more most likely to be malicious CNC hosts etc. The best practice here is to deny http/ssl to ip addresses.

Blue Coat provides a way to create a filter of the kind http(s)://\d+\.\d+\.\d+\.\d+, but this does not appear to be possible in PA.

Apologies for not clarifying this initially. I thought this would be a common question.

Ash

[mikand]

I think you can do this yourself with a custom url filter.

Otherwise the "proper" solution is to create a custom blacklist rule in front of the other rules (maybe put a whitelist rule in front of the blacklist one :smileysilly:) where you block bad dstip's.

PANDB should be able to be more granular than the Brightcloud db, but I dunno if the PANDB includes ip addresses as "hostnames" or not - parhaps someone from PA (who is lurking this forum) could answer that?

[dyang]

I think I heard my name 

PAN-DB does include IP address categorization, though the majority of entries are made up of URLs.  While a lot of malware does go directly to IP addresses, we've also noticed that many streaming media applications behave similarly (eg BBC iPlayer).  If you would like to safely enable these applications, use App-ID to do so.

--Doris

[akumar]

I have not considered moving to PAN-DB from the Brightcloud system. Too many unanswered questions such as quality of categorization, performance etc.

We already permit specific applications upfront.

What we would like to do is block all other traffic to IP addresses and deal with specific exceptions as a safer approach.

Ash

[mikand]

Then it should work if you only specify which categories you wish to allow - sites/ipaddresses not part of this whitelist will then be blocked and you get the effect you seem to be asking for.