Can an External Dyname List use an RSS feed for its list?

[Phil_Geho]

Is it possible to use an RSS feed to configure External or Dunamic lists? And if so, what's the procedure?

[BPry]

@Phil_Geho,

I'm not positive if you can directly from the PA itself or if you'll have to incorporate MineMeld to get it to read the RSS feeds and output into something usable by your PA. You can give it a try on your PA and see if it can do so directly without MineMeld fairly easily through CLI commands, if you're running 8.0 it's even easier since you can look at listings directly from the GUI 

[fjwcash]

Pretty sure the Dynamic Lists need to be just IP/netmask, one per line, which means RSS won't work (too much XML crap in the way).  You'd need to do all the RSS downloading, processing, and whatnot to generate a text file of the proper format for use with Dynamic Lists on a separate server, than make that file available for download from the firewall.

There's also a limitation (at least in PanOS 6.1.x) on the number of lines in a Dynamic List, so if it's longer than that, you need to manually split it into multiple files, and configure the firewall to download each one separately.

We have a process that grabs a "active hack attempts from these IPs/subnets in the past week" list from the Internet, massages it into the correct form, and splits it into multiple files.  The firewall is configured to download up to 9 files, add them all to a group, and use that group in the Security Policies.