Create an Advanced IP Defense Profile (PAN-OS 12.2.3 and Later)

1. Log in to the PAN-OS web interface.
2. Select ObjectsSecurity ProfilesAdvanced IP Defense and click Add to create a new profile or select an existing profile to edit.

   Alternatively, you can Clone a predefined profile to use as a template.

   Enter a Name and Description for the profile.

   Each profile contains:

   • Match rules—One or more rules that specify an IP attribute category, an optional tag filter, and an operation (Matches or Does not Match).
   • IP match field—Specifies whether the profile evaluates the source IP or destination IP of each session. This setting applies to all rules in the profile.
   • Action—Each rule specifies an action: Allow (Permit), Alert (Permit and Log), Block (Drop & Log), or Deny (Drop).
   • Log severity—Configurable per rule to control how the match appears in your threat logs.
   • Cache-miss behavior—On a cache miss, the enforcement point allows the initial session to pass (fail-open) and asynchronously queries Advanced IP Defense for a verdict. Once Advanced IP Defense responds, the local cache is populated and the policy is enforced on all subsequent sessions matching that IP. If you configure the profile for strict enforcement, the enforcement point drops traffic on cache miss only while Advanced IP Defense is reachable; if Advanced IP Defense becomes unreachable, the enforcement point reverts to fail-open to prevent a network outage.

   Three predefined profiles ship with the content update package: default, best-practice_outbound, and best-practice_inbound. The default profile sets all rules to Alert (Permit and Log), giving you immediate visibility into IP-based threats without blocking traffic. The best practice profiles include Block actions for the highest-severity threats. You can clone any predefined profile to create custom profiles tailored to your security requirements.

3. Configure policy rules within the Advanced IP Defense profile.

   Click Add to create rules that match traffic based on IP attributes or direct-to-IP detection. For each rule, specify:

   • Match criteria—Add one or more conditions, each with an operation (Matches or Does not Match), a category (such as Malware-C2, Anonymizers, or Direct-to-IP), and optional individual tags within the category. When a rule has multiple conditions, traffic must satisfy all conditions (AND logic). When a single condition contains multiple tags, traffic must match any one of them (OR logic). When a profile contains multiple rules, rules are evaluated top-down and the first matching rule determines the action. To create OR logic across categories, use separate rules.
   • Action—Choose Allow (Permit) to pass traffic without logging, Alert (Permit and Log) to log and allow, Block (Drop & Log) to log and drop, or Deny (Drop) to drop without logging. Start with Alert during initial deployment to evaluate detection accuracy before enabling Block.
   • Log severity—Set the severity level (Critical, High, Medium, Low, or Informational) to control how the match appears in your threat logs and SIEM. Higher severity levels can trigger automated responses through log forwarding profiles.

   When you build match rules, the following constraints apply:

   • Maximum 8 conditions per rule and 64 rules per profile.
   • You can match by an entire category (shown as [*]) or by individual tags within a category, but not both in the same rule.
   • The Direct-to-IP category has no individual tags. When you select it, the rule evaluates whether the connection occurred without a preceding DNS resolution.
   • The Association category supports tag-based matching only. You must specify individual tags (such as aws_cloud, gcp_cloud, or cdn_provider) rather than matching the entire category.
   • A Does not Match condition accepts only one category.

   Rules are evaluated in order from top to bottom. The first matching rule determines the action. Position your most specific, highest-severity rules at the top of the list, as described in Security Policy. As you build a rule, a summary of the match logic displays above the conditions. After you save the rule, this summary also appears in the Match Criteria column of the rules list so you can review the logic without opening each rule.
4. Click the Exceptions tab to define entries that bypass Advanced IP Defense evaluation.

   Exceptions prevent false positives for known-good traffic without disabling protection for other connections.

   Click Add to reference an IP-based External Dynamic List (EDL) that contains known-good IP addresses you want to exclude from Advanced IP Defense evaluation. Use EDLs for dynamic infrastructure where IP addresses change frequently (such as your own cloud services or CDN providers). The EDL updates automatically without requiring a commit. See External Dynamic Lists for EDL configuration details.

   Exceptions are evaluated before policy rules. If a connection matches an exception, the Advanced IP Defense check is skipped for that connection.
5. Click OK to save the Advanced IP Defense profile.

   The profile is now created and ready to be attached to security zones.
6. Select NetworkZones and attach the Advanced IP Defense profile to security zones.

   Select the zone where you want to enforce Advanced IP Defense policies. In the zone configuration, select the Advanced IP Defense profile you created from the IP Defense Profile dropdown under Advanced IP Defense.

   You can attach the same profile to multiple zones or create different profiles for different zones based on your security requirements. For example, apply a strict blocking profile to your internet-facing untrust zone and an alert-only profile to internal zones during the initial deployment period.

   For zone configuration and profile assignment, see Configure a Zone.
7. Commit your changes.
8. Monitor Advanced IP Defense activity.

   Use one or both of the following options to monitor traffic that matched your Advanced IP Defense rules:

   • Threat logs—Select MonitorLogsThreat on the enforcement point to view logs for sessions that matched Advanced IP Defense rules. You can filter logs by IP attributes, direct-to-IP detection, or specific rules to track blocked threats and validate policy effectiveness.
   • Activity Insights—If you forward logs to Strata Logging Service, you can view Advanced IP Defense threat activity in Activity Insights in Strata Cloud Manager. Activity Insights provides aggregated visibility into Advanced IP Defense detections across your deployment, including trending threats, top-targeted destinations, and detection coverage by category.