Adding Malicious IPs on security list manually on FWs which don't have threat protection license

[shafi021]

Hi Guys,

We have two firewalls with Threat prevention license and few other palo firewalls without threat prevention license. 

I have a requirement to create security rules to block malicious IPs. I can do this easily on FW which has Dynamic external list of malicious IPs because of license but I can't do same thing on other FWs which don't have threat prevention license. 

I can get the malicious IPs from FWs which has threat prevention license and can add them manually to block on FW without license.

I check and there are some around 3500+ malicious and 4000+ high risk IPs in Dynamic list. 

Can anyone suggest me how can I add these IPs in security list easily? It will be very difficult to create address objects for these IPs.

Is there any easy way, I can just copy past these IPs and add them in security list ?

Also, I know these IPs are dynamic and list's IPs can change anytime but my management want to do them anyway. 

Please provide any suggestion for this issue. Thank you so much. 

[shafi021]

@BPry @OwenFuller do you have any suggestions on this ? Your help will be appreciated. Thank you

[OwenFuller · Accepted solution]

Getting a Threat Prevention license and using an EDL would be the obvious solution. However, you could also create a "Malicious-IPs" address group and assign addresses to it via the CLI using set commands. This might save you some time.
How to Add and Verify Address Objects to Address Group and Secu... - Knowledge Base - Palo Alto Netw...