Automatic IP block-list PAN 8.0

cancel
Showing results for 
Search instead for 
Did you mean: 

Automatic IP block-list PAN 8.0

L0 Member

Hello all,

 

I am wondering if there is any way to let's say block the IP address from a source for a set period of time.  An example of this could be, we are being attack, same IP address hitting our firewall a 100 times in 3 minutes, It is being reported as "code execution vulnerability."  Now the action is dropped, but the IP address could be running some other exploit at the same time, and not recognized by the firewall as such or maybe it is.  I am looking for a way to automate a process by which we can setup some kind of rule to block that IP address, of the source, for a set period of time. 

 

Basic I am looking for a way to say look I am being hit by this IP on multiple ports and they are for different services all with let say 2 minutes.  I want to be able to automatically block that source for let say 5-10 minutes to see if it happens again and if it does the add it to the external block-list.

 

Any assistance would be greatly appreciated. 

 

1 ACCEPTED SOLUTION

Accepted Solutions

L7 Applicator

You can do this by configuring a Threat Exception and changing the Action to block-ip.

You can define the block time for the block-ip action.

 

Here are a couple KB's on this subject:

 

https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/How-to-Block-A-Threat-For-a-Speci...

 

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat-prevention/customize-the-acti...

View solution in original post

3 REPLIES 3

L7 Applicator

You can do this by configuring a Threat Exception and changing the Action to block-ip.

You can define the block time for the block-ip action.

 

Here are a couple KB's on this subject:

 

https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/How-to-Block-A-Threat-For-a-Speci...

 

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat-prevention/customize-the-acti...

View solution in original post

L2 Linker

With Block-IP you can drop traffic for a defined period, between 1 and 3600 seconds. Take care when apply because legitimate sources could also be blocked.

L1 Bithead
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!