How to block traffic from a specific ASN using DAG

[Layne-Corbett]

I could use some assistance since AI sucks and gives you the wrong info.

Here's what I would like to do, we already geoblock but I need to block malicious traffic (multible IP ranges) that's associated with a specific ASN.  I've tried creating a dynamic address group with the following match criteria:  'ip.src.asnum AS14956'.  I initially tried it without the AS in front of the number, but when I check, there are not IP ranges in the group.  When I googled it initially, AI said to use ip.geoip.asnum but when it errored out and I google some more found that it was replaced with ip.src.asnum which is what I'm using as the match criteria.

Since documentation is not very good for what match criteria can be used, can someone please help me with this because I would also like to block all the scans from "shadowservers" and they have a ton of IP's as well.

[BPry]

@Layne-Corbett,

You could use something like this https://iserv.nl/files/edl/feed.php if you didn't want to build out my own way of doing this via a script and an EDL that the firewall pulls. Personally, I would highly recommend building it out yourself so that you aren't dependent on some random resource online and you can customize it to your own liking. 

You could utilize something like https://api.bgpview.io/asn/14956/prefixes for collecting the addresses and then feed them in as an EDL after (ideally) doing some validation to make sure that you aren't going to break things. 

It looks like AI pulled together some dynamic tags that would come into play if you had VM information sources configured and actively monitored. I've never once seen any reference to ip.src.asnum or ip.geoip.asnum in PAN-OS and the only thing I can find is AI generation when looking for them. This appears to be a complete hallucination and it has you going down a very incorrect path.