Dynamic List for URL Filtering

[RyanJohnstone]

Hello,

We would like to use the Dynamic list for URL filtering function but we want to pick up the list from an internal web server, the link below says the path with follow the service route for palo udpates but this for us will be out to internet, the web server we want to store the list is internal.

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/policy/external-dynamic-list#_72960

Is there anyway to do this please?

Thanks

Ryan

[rmfalconer]

Just to make sure, you have a URL list on an internal server and you want to have an EDL read from that?

If so, you need to run an internal web server and then put your URL list, in .txt format, on that server. 

Then create a new EDL and point the source to your internal server.

[RyanJohnstone]

Hi there, thanks for the response.

The question is how the Firewall gets to the .TXT file.  From the link in my post, you can see it says that it will use the route configured in the service route configuration for Palo Alto updates, for us this is the internet, BUT the web server with the .TXT file is not on the internet but on an internal server, so I need to direct the Firewall internal to get the .TXT URL list file not via the servcie route configuration?

Hope this is clear

Thanks

Ryan

[BPry]

@RyanJohnstone,

If your service route doesn't have access to the EDL that you are looking to pull, there isn't a way to grab it. You would need to address that first and get it so that it isn't just thrown out to the internet and allow it the internal access it needs to get the txt file. 

You could get around this by pushing that txt file to something like Pastbin in an automated fashion so that the firewall wouldn't need access to the internal network. That's about as good of a 'solution' as possible. 

[Remo]

@RyanJohnstone

You could try to set a custom ip based service route which routes traffic to your internal webserver out of the internal interface.

[rmfalconer]

@RyanJohnstone

Since you included a link for PanOS 7.1, I assume that's what you're using.

Another, more intrusive, option is to upgrade to PanOS 8. It has a separate service route option for EDL.

[RyanJohnstone]

Is this set under the destination tab of the service route configuraiton?

[RyanJohnstone]

yes we are on 7.x...we have no plans to go to 8.x as of yet but useful to know this feature is available here, thanks for the response.

Ryan

[Remo]

---

@RyanJohnstone wrote:

Is this set under the destination tab of the service route configuraiton?

---

Yes