Dynamic Block List Question.

[Apadilla]

Hello Community,

Blacklist (such as IP Void or SpamHaus) with a suggestion that we should block that IP.  

I'm hoping there's a way that we can leverage such a blacklist - for example, to have a rule in the FW that references an existing Blacklist (such as IP Void) and is able to dynamically update based upon the published list.  

I know that the Palo Alto has a 'Dynamic Block List' option, but I"m not sure if there's a way to use that to make this work or not.  Any insights or feedback you could provide would be appreciated.

Best Regards

[kiwi]

Hi,

That is possible.

First create your DBL :

After that you can simply refer to the DBL object in your security policy :

Hope this helps,

-Kim.

[Raido_Rattameister]

And rule action should not be Allow as it is on screenshot 🙂

[Apadilla]

Kiwi,

Do you know if is possible to updating automatically this file ? I mean,  if it is possible this information is comming from a thirth party or organization that publish a blacklist like as raimbow tables.

best regards

[holtcg]

I believe you just specify how often you want the list imported with the Repeat setting.  

[Apadilla]

Hello,

Do you know if PA has a blacklist file or site, where I can update my DBL ?

[Raido_Rattameister]

Not that I'm aware of.

But you can use OpenBL one for example.

www.openbl.org

Address has to contain full address to the blacklist.

Like

http://www.openbl.org/lists/base_60days.txt

[holtcg]

I'm sure they don't.  

[OtakarKlier · Accepted solution]

Hello,

PAN does their own and its incorporated into one of the other fetaures, so yes it does this for you if you already have dynamic updates available.

Here is what I setup on mine:

Source on PAN support:

https://live.paloaltonetworks.com/message/54183#54183

Sans notes on this:

https://isc.sans.edu/forums/diary/Subscribing+to+the+DShield+Top+20+on+a+Palo+Alto+Networks+Firewall...

Others listed on this site:

http://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt

http://malc0de.com/bl/IP_Blacklist.txt

http://panwdbl.appspot.com/lists/openbl.txt

http://panwdbl.appspot.com/

Need to add?

http://cinsscore.com/list/ci-badguys.txt

Hope this helps!