IP List limitations

[ksauer507]

We would like to integrate with AbuseIPDB after seeing numerous global protect VPN logon failures.  We've greatly slowed this process down but it was a manual process of pulling reports to a list and we have an EDL download this list on a regularly scheduled basis.

Instead of a manual process, we were going to with Panorama API key and scripting report to AbuseIPDB and also ingest from AbuseIPDB.  However, if we even decide to pull in IP blocks with a 95% confidence level, that's 67,307 IP addresses (a constantly moving target).  If we move that up to 100% confidence level of malicious IPs, that brings it down to about 62,000 IP addresses.

We have 4th gen firewalls in our Primary data center, the 1420's.  We have 460's in or DR datacenter (which was getting attacked just as hard).  When we look at capacities, we see in list type IPs there is only a total capacity of 50,000 IP addresses.

With pfSense and OpnSense - FREE (unless you buy their hardware and support them), the limit for IP address lists, also known as aliases, is defined by the "Firewall Maximum Table Entries" setting, which defaults to 400,000 entries; meaning you can store up to 400,000 IP addresses across all your aliases within the firewall tables, and you may need to increase this value if you plan to use large lists of IP addresses in your firewall rules.  So with a free solution on a well enough box, you can even set some tunables to go past 400,000.

So is the Palo alto firewalls just cadalac boxes on plastic wheels?  Is there any way to overcome this limitation?

Would summarizing IPs count as 1 ip?  For example, if entering an IP as a /24, would that count as one entry, or 255 entries (the amount of IP's that CIDR network notation covers?)

Anyone put another appliance in front of Palo Alto, in a highly available way for additional filtering?
This is just an asinine limitation.  These firewalls costs in the 6 figures, granted that includes 5 years of support.  Why such a puny IP space?