Automatic IP block-list PAN 8.0

Reply
Highlighted
L0 Member

Automatic IP block-list PAN 8.0

Hello all,

 

I am wondering if there is any way to let's say block the IP address from a source for a set period of time.  An example of this could be, we are being attack, same IP address hitting our firewall a 100 times in 3 minutes, It is being reported as "code execution vulnerability."  Now the action is dropped, but the IP address could be running some other exploit at the same time, and not recognized by the firewall as such or maybe it is.  I am looking for a way to automate a process by which we can setup some kind of rule to block that IP address, of the source, for a set period of time. 

 

Basic I am looking for a way to say look I am being hit by this IP on multiple ports and they are for different services all with let say 2 minutes.  I want to be able to automatically block that source for let say 5-10 minutes to see if it happens again and if it does the add it to the external block-list.

 

Any assistance would be greatly appreciated. 

 


Accepted Solutions
L7 Applicator

You can do this by configuring a Threat Exception and changing the Action to block-ip.

You can define the block time for the block-ip action.

 

Here are a couple KB's on this subject:

 

https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/How-to-Block-A-Threat-For-a-Speci...

 

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat-prevention/customize-the-acti...

View solution in original post


All Replies
L7 Applicator

You can do this by configuring a Threat Exception and changing the Action to block-ip.

You can define the block time for the block-ip action.

 

Here are a couple KB's on this subject:

 

https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/How-to-Block-A-Threat-For-a-Speci...

 

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat-prevention/customize-the-acti...

View solution in original post

Highlighted
L2 Linker

With Block-IP you can drop traffic for a defined period, between 1 and 3600 seconds. Take care when apply because legitimate sources could also be blocked.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!