Threat Intelligence External Dynamic Lists vs URL Filtering Security Profile

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Threat Intelligence External Dynamic Lists vs URL Filtering Security Profile

L1 Bithead

Hi All,

I have security profiles on my main egress firewall rules, and the URL filtering is blocking anything malware, high-risk etc. I have some custom reports setup that report on any blocks that take place as a result of this profile.

 

I am reading you can also setup firewall rules to block inbound/outbound traffic using sources and destinations that are External Dynamic Lists of known malicious IP addresses, high-risk IP addresses, bulletproof IP addresses etc. (https://docs.paloaltonetworks.com/best-practices/10-2/internet-gateway-best-practices/best-practice-...)

 

Why would I use these rules with EDL's vs URL filtering security profile? Or should both be used for best protection? Am I correct in thinking that the EDL's are a protection at a layer 3 level, and the URL filtering is more of a layer 7 protection?

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Hi @Nick_Davis1639 ,

 

That is 100% correct.  The built-in EDLs are lists of IP addresses (layer 3).  You can view the entries (and create exceptions) under Objects > External Dynamic Lists > click on EDL > List Entries and Exceptions.

 

The URL categories are URLs.  They work at layer 7, and only work with web-browsing and ssl.  The EDLs will block all applications.

 

The BPA recommends implementing both.

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

View solution in original post

1 REPLY 1

Cyber Elite
Cyber Elite

Hi @Nick_Davis1639 ,

 

That is 100% correct.  The built-in EDLs are lists of IP addresses (layer 3).  You can view the entries (and create exceptions) under Objects > External Dynamic Lists > click on EDL > List Entries and Exceptions.

 

The URL categories are URLs.  They work at layer 7, and only work with web-browsing and ssl.  The EDLs will block all applications.

 

The BPA recommends implementing both.

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.
  • 1 accepted solution
  • 1512 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!