Dynamic Block List Site

[das]

Is there a list of known bad IP addresses? I would like to include a dynamic block list in my policy but I don't have a list of known bad IP addresses. Does Palo Alto have a canned list of IPs that I can reference to insert into my policy?

[wesa]

Paloalto doesn't have list of bad ips database. you may use spamhaus.org to obtain that information but that would be a lot of work for you. I think the best practice for you is to focus on specific bad ips that are hitting your firewall and create a policy based on that

[gafrol · Accepted solution]

I filed a feature request long time ago to have a feature known as Reputation based (DNS/IP) block list which works very well with one of the top IPS vendors in the market.

Until now nothing has been implemented so far, although BrightCloud already has a Reputation based Database which could be a source for this feature

http://brightcloud.com/toc/webreputation.php

[mikand]

Hopefully this should be doable with PANDB or similar.

As a workaround you can download bad ip's like http://support.clean-mx.de/clean-mx/viruses.php among other places, create a txt-file with the bad ip's and use the dynamic rule stuff in PANOS 5.x (I think it was introduced) where the firewall every 5 minutes (or so depending on setting) will download this ip-list from your server and put this dynamically in a group which then is used to either allow or deny traffic.

[dyang]

Hi everyone,

Thanks for your comments - as mentioned, Palo Alto Networks does not have a downloadable list of bad/malicious IP addresses for people to import.  Instead, as our threat team identifies malware, they automatically take any URL or IP associated with that threat and will include it as part of the PAN-DB URL filtering database. 

There are certainly a number of 3rd party vendors such as spamhaus.org that provide downloadable lists that you are welcome to use with the dynamic block list feature.

--Doris

[jkim2]

Use at your own risk but below are some sites to test the dynamic block, its not a long list but its a simple txt

Make sure you create a service route for the DNS , then select the dynamic block object as destination and test with ping before & after.

http://www.ciarmy.com/list/ci-badguys.txt

http://www.malwaredomainlist.com/hostslist/ip.txt

[Mike_Walsh]

Doris,

I am new to Palo Alto.  Getting asked this same question about IP Reputation lists.   I assume that your reply would still be the same today.   Need to get back to the customer and just want to confirm.

Thanks...

Mike