>
    Strata Copilot
    Test Advanced IP Defense Rules with Reserved IP Addresses
    Focus
    Download PDF
    Focus
    1. Home
    2. Advanced IP Defense
    3. Test Advanced IP Defense Rules with Reserved IP Addresses
    Download PDF
    Advanced IP Defense

    Test Advanced IP Defense Rules with Reserved IP Addresses

    Table of Contents

    Test Advanced IP Defense Rules with Reserved IP Addresses

    Use a dedicated pool of reserved IP addresses with pre-configured attributes to validate Advanced IP Defense profile rules and demonstrate detection capabilities.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by Strata Cloud Manager)
    • NGFW (Managed by PAN-OS or Panorama)
    • VM-Series
    • Advanced IP Defense license
    • PAN-OS 12.2.3 and later
    Palo Alto Networks maintains a dedicated pool of IP addresses with pre-configured attributes that represent common security scenarios. Each test IP is mapped to trigger exactly one primary rule in the default and best practice profiles, providing clear and predictable validation results. These IP addresses are not associated with any publicly accessible services and exist solely for testing and demonstration purposes.
    The reserved range is 198.135.184.112/28. Only the IP addresses listed in the following table are currently assigned test attributes. The remaining addresses in the range are reserved for future use.
    IP AddressAssigned AttributesTriggered RuleProfile
    198.135.184.112malware_c2
    Malware-C2 [malware_c2, in_shellcode]
    Malware-C2 [*]
    Default
    Best practice outbound
    Best practice inbound
    198.135.184.113bulletproof_hosting
    High-Risk [bulletproof_hosting]
    High-Risk [*]
    Default
    Best practice outbound
    Best practice inbound
    198.135.184.114tor_exit
    Anonymizers [tor_exit]
    Anonymizers [*]
    Default
    Best practice outbound
    Best practice inbound
    198.135.184.115private_proxy, residential_isp
    Direct-to-IP AND Association [public_cloud, residential_isp] AND NOT Association [aws_cloud, azure_cloud, gcp_cloud, oci_cloud]
    Anonymizers [open_proxy, private_proxy] AND Association [residential_isp]
    Default
    Best practice outbound
    Best practice inbound
    198.135.184.116scanning_brute_force
    Abuse [scanning_brute_force]
    Abuse [*]
    Best practice inbound
    Default
    Best practice outbound
    Best practice inbound
    198.135.184.117exposed_vulnerable_serviceVulnerable [*]
    Default
    Best practice outbound
    Best practice inbound
    Before you begin
    Ensure you have an Advanced IP Defense profile attached to the security zone where you will generate test traffic. For setup instructions, see Create an Advanced IP Defense Profile (PAN-OS 12.2.3 and Later) and Create Advanced IP Defense Policy Rules in PAN-OS and Panorama.
    Testing outbound rules (destination IP evaluation)
    To validate outbound rules, initiate connections from a host behind the firewall to one of the test IP addresses. The firewall evaluates the destination IP against the Advanced IP Defense profile and triggers the corresponding rule. You can use any connection method (such as curl, ping, or a web browser) to generate traffic toward the test IP.
    Testing inbound rules (source IP evaluation)
    Inbound rule testing requires traffic arriving at the firewall with a test IP as the source address. Because upstream anti-spoofing controls drop spoofed packets originating from the public internet, you must generate this traffic in a controlled environment:
    • Place a traffic-generating device on the untrust side of the firewall and assign or spoof one of the test IP addresses as the source. Use packet crafting tools (such as scapy or hping3) to send packets with the test IP as the source address toward an internal host.
    • In a lab environment, configure a device on the untrust-zone interface with one of the reserved test IPs and initiate connections toward the trust zone.
    Inbound testing cannot be performed from the internet or from behind the firewall's trust zone. The traffic must enter through an untrust interface with the test IP as the packet source address for the firewall to evaluate it against inbound rules.

    © 2026 Palo Alto Networks, Inc. All rights reserved.