Automatic IP block-list PAN 8.0

[ebenditt1]

Hello all,

I am wondering if there is any way to let's say block the IP address from a source for a set period of time.  An example of this could be, we are being attack, same IP address hitting our firewall a 100 times in 3 minutes, It is being reported as "code execution vulnerability."  Now the action is dropped, but the IP address could be running some other exploit at the same time, and not recognized by the firewall as such or maybe it is.  I am looking for a way to automate a process by which we can setup some kind of rule to block that IP address, of the source, for a set period of time. 

Basic I am looking for a way to say look I am being hit by this IP on multiple ports and they are for different services all with let say 2 minutes.  I want to be able to automatically block that source for let say 5-10 minutes to see if it happens again and if it does the add it to the external block-list.

Any assistance would be greatly appreciated. 

[mivaldi · Accepted solution]

You can do this by configuring a Threat Exception and changing the Action to block-ip.

You can define the block time for the block-ip action.

Here are a couple KB's on this subject:

https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/How-to-Block-A-Threat-For-a-Speci...

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat-prevention/customize-the-acti...

[ACortes]

With Block-IP you can drop traffic for a defined period, between 1 and 3600 seconds. Take care when apply because legitimate sources could also be blocked.

[Ricardo-GTZ]

This maybe of use to you.

check it out.

https://www.smartcloudcomputing.net/2021/02/22/how-to-automatically-blacklist-an-attackers-ip-on-pal...