>
    Strata Copilot
    Advanced IP Defense Exceptions and Allowlists
    Focus
    Download PDF
    Focus
    1. Home
    2. Advanced IP Defense
    3. Advanced IP Defense Exceptions and Allowlists
    Download PDF
    Advanced IP Defense

    Advanced IP Defense Exceptions and Allowlists

    Table of Contents

    Advanced IP Defense Exceptions and Allowlists

    Advanced IP Defense uses EDL-based exceptions and cloud-managed allowlists to exclude legitimate traffic from policy enforcement and reduce false positives.
    Where Can I Use This?What Do I Need?
    • PAN-OS 12.2.3 and later
    • Strata Cloud Manager
    • Advanced IP Defense license
    • Admin access to firewall or Strata Cloud Manager
    • Advanced IP Defense profile created
    Blocking IP addresses carries a high risk of disrupting legitimate traffic. To prevent false positives, Advanced IP Defense provides two tools:
    • Exceptions—Let you exclude specific, user-defined traffic from Advanced IP Defense evaluation.
    • Built-in Allowlists—Pre-populate the firewall with known-safe entries. This skips cloud lookups for benign addresses and ignores direct-to-IP checks for protocols that normally connect without DNS resolution.
    Together, these features improve performance and accuracy by reducing the number of required cloud lookups.
    Exceptions
    Exceptions are the user-configurable mechanism for excluding traffic from Advanced IP Defense evaluation. Within the Exceptions tab of an Advanced IP Defense profile, you can reference one or more IP-based External Dynamic Lists (EDLs) that contain known-good IP addresses. When a connection's IP matches an entry in a referenced EDL, Advanced IP Defense skips evaluation for that connection.
    Use EDL exceptions for dynamic infrastructure where IP addresses change frequently, such as your own cloud services, CDN providers, or partner networks. Because EDLs update automatically, your exceptions stay current without requiring a commit each time the IP list changes.
    Built-in Allowlists
    Advanced IP Defense maintains two built-in allowlists that are pre-populated on the firewall. These allowlists are pushed from Advanced IP Defense and are not user-configurable.
    • AIPD Allowlist—Skips cloud attribute lookups entirely for known-safe IP addresses, letting traffic pass without enforcement. The cloud stores the full list, while the firewall receives a per-tenant subset ordered by priority and sized to its available memory. Firewalls without a Tenant Service Group (TSG) receive a default list.
    • No-DNS Allowlist—Skips the direct-to-IP detection check for protocols that normally connect directly to IP addresses, treating the traffic as if a prior DNS resolution occurred. Other IP attribute checks still proceed normally. Both the cloud and the firewall maintain per-tenant lists. Firewalls without a TSG receive a default list.
    Internal network protocols like DHCP, mDNS, and NetBIOS do not need allowlisting because Advanced IP Defense only evaluates publicly routable IP addresses.
    Exceptions and allowlists are evaluated before profile rules. If a connection matches an exception or a built-in allowlist entry, the corresponding Advanced IP Defense check is skipped for that connection before any rules are evaluated.

    Configure Advanced IP Defense EDL Exceptions (Strata Cloud Manager)

    Reference External Dynamic Lists (EDLs) in your Advanced IP Defense profile in Strata Cloud Manager to exclude known-good IP addresses from Advanced IP Defense evaluation.
    EDL exceptions allow you to exclude traffic destined to or originating from known-good IP addresses from Advanced IP Defense evaluation. When a connection's IP matches an entry in a referenced EDL, the firewall skips Advanced IP Defense checks for that connection. Use EDL exceptions for dynamic infrastructure where IP addresses change frequently, such as your own cloud services or CDN providers.
    1. Log in to Strata Cloud Manager.
    2. Select ConfigurationSecurity ServicesAdvanced IP Defense and select the profile where you want to add exceptions.
    3. Click the Exceptions tab.
    4. Click Add to add an EDL exception.
      In the External Dynamic List dialog, select an existing IP-based EDL from the External Dynamic List dropdown. The EDL must already be configured under ConfigurationObjectsExternal Dynamic Lists. The exception applies to all traffic matching the EDL. See External Dynamic Lists for EDL configuration details.
    5. Click OK to save the exception, then click Save to save the profile.
    6. Push your changes.
    After pushing, verify that the exception is working correctly by checking Incidents and AlertsLog Viewer to confirm that traffic matching the EDL is no longer triggering Advanced IP Defense rules.

    Configure Advanced IP Defense EDL Exceptions (PAN-OS and Panorama)

    Reference External Dynamic Lists (EDLs) in your Advanced IP Defense profile to exclude known-good IP addresses from Advanced IP Defense evaluation.
    EDL exceptions allow you to exclude traffic destined to or originating from known-good IP addresses from Advanced IP Defense evaluation. When a connection's IP matches an entry in a referenced EDL, the firewall skips Advanced IP Defense checks for that connection. Use EDL exceptions for dynamic infrastructure where IP addresses change frequently, such as your own cloud services or CDN providers.
    1. Log in to the PAN-OS web interface.
    2. Select ObjectsSecurity ProfilesAdvanced IP Defense and select the profile where you want to add exceptions.
    3. Click the Exceptions tab.
      Exceptions tab
    4. Click Add to add an EDL exception.
      Selecting an External Dynamic List
      In the External Dynamic List dialog, select an existing IP-based EDL from the External Dynamic List dropdown. The EDL must already be configured under ObjectsExternal Dynamic Lists. The exception applies to all traffic matching the EDL. See External Dynamic Lists for EDL configuration details.
    5. Click OK to save the exception, then click OK to save the profile.
      Exceptions tab with an EDL exception configured
    6. Commit your changes.
    After committing, verify that the exception is working correctly by monitoring MonitorLogsThreat to confirm that traffic matching the EDL is no longer triggering Advanced IP Defense rules.

    © 2026 Palo Alto Networks, Inc. All rights reserved.