- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
03-27-2013 01:24 PM
So these Ips don't resolve to host name?
03-27-2013 01:46 PM
A lot of poorly intended code (read malware) are designed to go directly to IP addresses that may or may not resolve to nicely constructed dns names. In my experience, these more most likely to be malicious CNC hosts etc. The best practice here is to deny http/ssl to ip addresses.
Blue Coat provides a way to create a filter of the kind http(s)://\d+\.\d+\.\d+\.\d+, but this does not appear to be possible in PA.
Apologies for not clarifying this initially. I thought this would be a common question.
Ash
03-28-2013 02:29 PM
I think you can do this yourself with a custom url filter.
Otherwise the "proper" solution is to create a custom blacklist rule in front of the other rules (maybe put a whitelist rule in front of the blacklist one :smileysilly:) where you block bad dstip's.
PANDB should be able to be more granular than the Brightcloud db, but I dunno if the PANDB includes ip addresses as "hostnames" or not - parhaps someone from PA (who is lurking this forum) could answer that?
03-28-2013 03:24 PM
I think I heard my name
PAN-DB does include IP address categorization, though the majority of entries are made up of URLs. While a lot of malware does go directly to IP addresses, we've also noticed that many streaming media applications behave similarly (eg BBC iPlayer). If you would like to safely enable these applications, use App-ID to do so.
--Doris
03-29-2013 08:51 AM
I have not considered moving to PAN-DB from the Brightcloud system. Too many unanswered questions such as quality of categorization, performance etc.
We already permit specific applications upfront.
What we would like to do is block all other traffic to IP addresses and deal with specific exceptions as a safer approach.
Ash
03-29-2013 02:33 PM
Then it should work if you only specify which categories you wish to allow - sites/ipaddresses not part of this whitelist will then be blocked and you get the effect you seem to be asking for.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!