>
    Strata Copilot
    Create an Advanced IP Defense Profile
    Focus
    Download PDF
    Focus
    1. Home
    2. Advanced IP Defense
    3. Create an Advanced IP Defense Profile
    Download PDF
    Advanced IP Defense

    Create an Advanced IP Defense Profile

    Table of Contents

    Create an Advanced IP Defense Profile

    Configure Advanced IP Defense to enforce real-time IP address inspection and block threats that bypass traditional DNS and URL-based controls.
    Where Can I Use This?What Do I Need?
    • PAN-OS 12.2.3 and later
    • Strata Cloud Manager
    • PAN-OS 11.1.x and later (EDL-based)
    • Advanced IP Defense license
    • Admin access to firewall or Strata Cloud Manager
    • Network connectivity to Advanced IP Defense
    Advanced IP Defense is a cloud-delivered security service that provides real-time, context-aware IP address inspection and enforcement. It closes a critical security gap by protecting against threats that bypass traditional DNS and URL-based controls by operating directly at the IP layer.
    The service addresses two major attack vectors. Outbound threats occur when malware establishes direct-to-IP connections to exfiltrate data or maintain Command & Control (C2) communications, bypassing DNS and URL inspection controls. Inbound threats involve attackers using large-scale automation, proxies, and anonymizers to perform scanning, reconnaissance, and exploitation of network resources.
    Advanced IP Defense leverages dynamic, real-time IP attributes to enable granular, context-aware security policies. By correlating traffic with DNS resolution data, the Advanced IP Defense detects direct-to-IP connections (connections without prior DNS resolution) and applies zero trust IP policies to block suspicious activity while allowing legitimate business traffic.
    For PAN-OS 12.2.3 and later or Strata Cloud Manager, you configure Advanced IP Defense through a zone-based profile. Each profile contains a name, a description, and a match field that specifies whether to evaluate the source or destination IP of each session. The profile includes one or more rules each with a name, an action, a log severity, and match criteria that define which IP attributes trigger enforcement. The profile can also include zero or more exceptions for IPs or networks you want to exclude from enforcement.
    The firewall maintains a local cache of IP attributes and DNS resolution history to minimize cloud lookups. When the enforcement point encounters an IP with no local cache entry, it allows the initial session to pass (fail-open) and queries Advanced IP Defense asynchronously. Once a verdict is returned and cached locally, subsequent sessions to that IP are evaluated against your profile rules. If the Advanced IP Defense cloud service is unreachable, the firewall continues to fail open to prevent network outages.
    For customers on PAN-OS 11.1.x and later, Advanced IP Defense intelligence is also available through predefined External Dynamic Lists (EDLs) delivered via the AV content package. These lists contain curated subsets of high-risk malicious IPs identified by the cloud security engines. Advanced IP Defense automatically selects the appropriate EDL size (Standard or Extended tier) based on your hardware platform's capacity at install time. You can reference these EDLs in your existing security rules to block traffic based on malicious IP addresses. On PAN-OS 12.2.3 and later, you can use both the EDLs and the full profile-based controls; the profile-based approach is recommended for granular attribute-level matching, direct-to-IP detection, real-time cloud lookups, and enhanced logging.
    The configuration process is iterative and ongoing. After creating your initial profile, you refine policy rules based on traffic patterns and security requirements, adjust exceptions as your network evolves, and edit connectivity settings to maintain reliable communication with Advanced IP Defense.

    Create an Advanced IP Defense Profile (Strata Cloud Manager)

    Configure Advanced IP Defense in Strata Cloud Manager to enable real-time IP address inspection and enforcement.
    Advanced IP Defense in Strata Cloud Manager provides centralized configuration of IP address inspection and enforcement for Strata Cloud Manager-managed NGFW and VM-Series firewalls. This enables you to protect your network against IP-based threats using dynamic IP attributes and direct-to-IP detection.
    1. Log in to Strata Cloud Manager.
    2. Select ConfigurationNGFW and Prisma AccessOverview and check the license usage terms link in the License panel to verify that you have an active Advanced IP Defense license.
    3. Select ConfigurationSecurity ServicesAdvanced IP Defense and click Add to create a new Advanced IP Defense profile or select an existing profile to edit it.
      Enter a name and description for the profile.
      Each profile contains:
      • Match rules—One or more rules that specify an IP attribute category, an optional tag filter, and an operation (Matches or Does not Match).
      • IP match field—Specifies whether the profile evaluates the source IP or destination IP of each session. This setting applies to all rules in the profile.
      • Action—Each rule specifies an action: Allow (Permit), Alert (Permit and Log), Block (Drop & Log), or Deny (Drop).
      • Log severity—Configurable per rule to control how the match appears in your threat logs.
      • Cache-miss behavior—On a cache miss, the firewall allows the initial session to pass (fail-open) and asynchronously queries Advanced IP Defense for a verdict. Once the cloud responds, the local cache is populated and the policy is enforced on all subsequent sessions matching that IP. If you configure the profile for strict enforcement, the firewall drops traffic on cache miss only while Advanced IP Defense is reachable; if Advanced IP Defense becomes unreachable, the firewall reverts to fail-open to prevent a network outage.
      Three predefined profiles ship with the content update package: default, best-practice_outbound, and best-practice_inbound. The default profile sets all rules to Alert (Permit and Log), giving you immediate visibility into IP-based threats without blocking traffic. The best practice profiles include Block actions for the highest-severity threats. You can clone any predefined profile to create custom profiles tailored to your security requirements.
      Predefined Advanced IP Defense profiles in Strata Cloud Manager
    4. Configure policy rules within the Advanced IP Defense profile.
      Click Add Rule to create rules that match traffic based on IP attributes or direct-to-IP detection. For each rule, specify:
      Add Rule dialog in Strata Cloud Manager
      • Match criteria—Add one or more conditions, each with an operation (Matches or Does not Match), a category (such as Malware-C2, Anonymizers, or Direct-to-IP), and optional individual tags within the category. When a rule has multiple conditions, traffic must satisfy all conditions (AND logic). When a single condition contains multiple tags, traffic must match any one of them (OR logic). When a profile contains multiple rules, rules are evaluated top-down and the first matching rule determines the action. To create OR logic across categories, use separate rules.
      • Action—Choose Allow (Permit) to pass traffic without logging, Alert (Permit and Log) to log and allow, Block (Drop & Log) to log and drop, or Deny (Drop) to drop without logging. Start with Alert during initial deployment to evaluate detection accuracy before enabling Block.
      • Log severity—Set the severity level (Critical, High, Medium, Low, or Informational) to control how the match appears in your threat logs and SIEM. Higher severity levels can trigger automated responses through log forwarding profiles.
      When you build match rules, the following constraints apply:
      • Maximum 8 conditions per rule and 64 rules per profile.
      • You can match by an entire category (shown as [*]) or by individual tags within a category, but not both in the same rule.
      • The Direct-to-IP category has no individual tags. When you select it, the rule evaluates whether the connection occurred without a preceding DNS resolution.
      • The Association category supports tag-based matching only. You must specify individual tags (such as aws_cloud, gcp_cloud, or cdn_provider) rather than matching the entire category.
      • A Does not Match condition accepts only one category.
      Rules are evaluated in order from top to bottom. The first matching rule determines the action. Position your most specific, highest-severity rules at the top of the list, as described in Security Policy. As you build a rule, a summary of the match logic displays above the conditions. After you save the rule, this summary also appears in the Match Criteria column of the rules list so you can review the logic without opening each rule.
    5. Configure exceptions.
      Click the Exceptions tab to define entries that bypass Advanced IP Defense evaluation. Exceptions prevent false positives for known-good traffic without disabling protection for other connections.
      Click Add to reference an IP-based External Dynamic List (EDL) that contains known-good IP addresses you want to exclude from Advanced IP Defense evaluation. Use EDLs for dynamic infrastructure where IP addresses change frequently (such as your own cloud services or CDN providers). The EDL updates automatically without requiring a commit. See External Dynamic Lists for EDL configuration details.
      Exceptions are evaluated before policy rules. If a connection matches an exception, the Advanced IP Defense check is skipped for that connection.
    6. Click OK to save the Advanced IP Defense profile.
      The profile is now created and ready to be attached to security zones.
    7. Select ConfigurationNetworkZones and attach the Advanced IP Defense profile to security zones.
      Select the zone where you want to enforce Advanced IP Defense policies. Attach the Advanced IP Defense profile you created.
      You can attach the same profile to multiple zones or create different profiles for different zones based on your security requirements. For example, apply a strict blocking profile to your internet-facing untrust zone and an alert-only profile to internal zones during the initial deployment period.
      See Configure a Zone for more information about zone configuration and profile assignment.
    8. Commit your changes.
      Click Commit to apply the Advanced IP Defense configuration.
    9. Monitor Advanced IP Defense activity.
      Use one or both of the following options to monitor traffic that matched your Advanced IP Defense rules:
      • Log Viewer—Select Incidents and AlertsLog Viewer to view logs for sessions that matched Advanced IP Defense rules. You can filter logs by IP attributes, direct-to-IP detection, or specific rules to track blocked threats and validate policy effectiveness.
      • Activity Insights—View Advanced IP Defense threat activity in Activity Insights for aggregated visibility into Advanced IP Defense detections across your deployment, including trending threats, top-targeted destinations, and detection coverage by category.
    After enabling Advanced IP Defense, monitor the logs regularly to track blocked threats and validate policy effectiveness. You can create additional profiles for different security zones or refine your existing rules based on traffic patterns and security requirements.

    PAN-OS & Panorama

    Enable Advanced IP Defense on PAN-OS 12.2.3 and later or on PAN-OS 11.1.x and later using predefined EDLs.

    Create an Advanced IP Defense Profile (PAN-OS 12.2.3 and Later)

    Configure Advanced IP Defense on your enforcement point to enable real-time IP address inspection and enforcement based on IP attributes and direct-to-IP detection.
    Advanced IP Defense provides real-time IP address inspection and enforcement to protect against threats that bypass traditional DNS and URL-based controls. By enabling Advanced IP Defense, you can enforce policies based on dynamic IP attributes and detect direct-to-IP connections that indicate potential malware or data exfiltration attempts.
    1. Log in to the PAN-OS web interface.
    2. Select ObjectsSecurity ProfilesAdvanced IP Defense and click Add to create a new profile or select an existing profile to edit.
      Alternatively, you can Clone a predefined profile to use as a template.
      Enter a Name and Description for the profile.
      Each profile contains:
      • Match rules—One or more rules that specify an IP attribute category, an optional tag filter, and an operation (Matches or Does not Match).
      • IP match field—Specifies whether the profile evaluates the source IP or destination IP of each session. This setting applies to all rules in the profile.
      • Action—Each rule specifies an action: Allow (Permit), Alert (Permit and Log), Block (Drop & Log), or Deny (Drop).
      • Log severity—Configurable per rule to control how the match appears in your threat logs.
      • Cache-miss behavior—On a cache miss, the enforcement point allows the initial session to pass (fail-open) and asynchronously queries Advanced IP Defense for a verdict. Once Advanced IP Defense responds, the local cache is populated and the policy is enforced on all subsequent sessions matching that IP. If you configure the profile for strict enforcement, the enforcement point drops traffic on cache miss only while Advanced IP Defense is reachable; if Advanced IP Defense becomes unreachable, the enforcement point reverts to fail-open to prevent a network outage.
      Three predefined profiles ship with the content update package: default, best-practice_outbound, and best-practice_inbound. The default profile sets all rules to Alert (Permit and Log), giving you immediate visibility into IP-based threats without blocking traffic. The best practice profiles include Block actions for the highest-severity threats. You can clone any predefined profile to create custom profiles tailored to your security requirements.
    3. Configure policy rules within the Advanced IP Defense profile.
      Click Add to create rules that match traffic based on IP attributes or direct-to-IP detection. For each rule, specify:
      • Match criteria—Add one or more conditions, each with an operation (Matches or Does not Match), a category (such as Malware-C2, Anonymizers, or Direct-to-IP), and optional individual tags within the category. When a rule has multiple conditions, traffic must satisfy all conditions (AND logic). When a single condition contains multiple tags, traffic must match any one of them (OR logic). When a profile contains multiple rules, rules are evaluated top-down and the first matching rule determines the action. To create OR logic across categories, use separate rules.
      • Action—Choose Allow (Permit) to pass traffic without logging, Alert (Permit and Log) to log and allow, Block (Drop & Log) to log and drop, or Deny (Drop) to drop without logging. Start with Alert during initial deployment to evaluate detection accuracy before enabling Block.
      • Log severity—Set the severity level (Critical, High, Medium, Low, or Informational) to control how the match appears in your threat logs and SIEM. Higher severity levels can trigger automated responses through log forwarding profiles.
      When you build match rules, the following constraints apply:
      • Maximum 8 conditions per rule and 64 rules per profile.
      • You can match by an entire category (shown as [*]) or by individual tags within a category, but not both in the same rule.
      • The Direct-to-IP category has no individual tags. When you select it, the rule evaluates whether the connection occurred without a preceding DNS resolution.
      • The Association category supports tag-based matching only. You must specify individual tags (such as aws_cloud, gcp_cloud, or cdn_provider) rather than matching the entire category.
      • A Does not Match condition accepts only one category.
      Rules are evaluated in order from top to bottom. The first matching rule determines the action. Position your most specific, highest-severity rules at the top of the list, as described in Security Policy. As you build a rule, a summary of the match logic displays above the conditions. After you save the rule, this summary also appears in the Match Criteria column of the rules list so you can review the logic without opening each rule.
    4. Click the Exceptions tab to define entries that bypass Advanced IP Defense evaluation.
      Exceptions prevent false positives for known-good traffic without disabling protection for other connections.
      Click Add to reference an IP-based External Dynamic List (EDL) that contains known-good IP addresses you want to exclude from Advanced IP Defense evaluation. Use EDLs for dynamic infrastructure where IP addresses change frequently (such as your own cloud services or CDN providers). The EDL updates automatically without requiring a commit. See External Dynamic Lists for EDL configuration details.
      Exceptions are evaluated before policy rules. If a connection matches an exception, the Advanced IP Defense check is skipped for that connection.
    5. Click OK to save the Advanced IP Defense profile.
      The profile is now created and ready to be attached to security zones.
    6. Select NetworkZones and attach the Advanced IP Defense profile to security zones.
      Select the zone where you want to enforce Advanced IP Defense policies. In the zone configuration, select the Advanced IP Defense profile you created from the IP Defense Profile dropdown under Advanced IP Defense.
      You can attach the same profile to multiple zones or create different profiles for different zones based on your security requirements. For example, apply a strict blocking profile to your internet-facing untrust zone and an alert-only profile to internal zones during the initial deployment period.
      For zone configuration and profile assignment, see Configure a Zone.
    7. Commit your changes.
    8. Monitor Advanced IP Defense activity.
      Use one or both of the following options to monitor traffic that matched your Advanced IP Defense rules:
      • Threat logs—Select MonitorLogsThreat on the enforcement point to view logs for sessions that matched Advanced IP Defense rules. You can filter logs by IP attributes, direct-to-IP detection, or specific rules to track blocked threats and validate policy effectiveness.
      • Activity Insights—If you forward logs to Strata Logging Service, you can view Advanced IP Defense threat activity in Activity Insights in Strata Cloud Manager. Activity Insights provides aggregated visibility into Advanced IP Defense detections across your deployment, including trending threats, top-targeted destinations, and detection coverage by category.
    After enabling Advanced IP Defense, you can create additional profiles for different security zones or refine your existing rules based on traffic patterns and security requirements. Monitor the logs regularly to ensure your policies are effective and adjust rules as needed.

    Create an Advanced IP Defense Profile (PAN-OS 11.1 and Later)

    Configure Advanced IP Defense on PAN-OS 11.1 and later using predefined External Dynamic Lists (EDLs) to block malicious IP addresses.
    For PAN-OS 11.1 and later, Advanced IP Defense is available through predefined External Dynamic Lists (EDLs) that are automatically delivered via content updates. These EDLs contain curated, priority-ranked lists of malicious IP addresses identified by Advanced IP Defense, allowing you to block threats using your existing security policy rules. On PAN-OS 12.2.3 and later, you can also use the full Advanced IP Defense profile-based architecture for granular attribute-level matching and direct-to-IP detection.
    The Advanced IP Defense EDLs are delivered in the antivirus content package and installed automatically when you update dynamic content. The system performs Top-K trimming at install time based on your hardware platform's EDL capacity, so the same content package works across all supported devices. Each list is ranked by priority in descending order (first entry = highest priority).
    Predefined Advanced IP Defense EDLs are supported on single-vsys configurations only. Multi-vsys enforcement point environments cannot deploy these EDLs across multiple virtual systems.
    1. Log in to the PAN-OS web interface.
    2. Select DeviceDynamic Updates and check for the latest antivirus content release. The Advanced IP Defense EDLs are delivered through this package. Schedule automatic updates to Schedule automatic updates to keep your enforcement point content current with the latest antivus content package.
    3. Select ObjectsExternal Dynamic Lists look for the predefined Advanced IP Defense EDLs are available.
      The AV content package delivers the same set of EDL files to all platforms. At install time, the system automatically trims each list to the appropriate size based on your hardware platform's capacity. You do not need to select a tier manually. Standard tier platforms (such as PA-3200, PA-3400, PA-3500, and PA-5500 series) receive a condensed record set, while Extended tier platforms (such as PA-1400, PA-5200, PA-5400, PA-7500 series, VM-Series, and Prisma Access) receive the complete record set.
      An IP address appears in only one EDL even if it has multiple attributes. When an IP qualifies for multiple lists, it is placed in the highest-severity list based on the following priority (highest to lowest): C2 infrastructure, Hardcoded in malware, VPN, Proxies, Scanner and brute-force, Exposed vulnerable services.
    4. Select PoliciesSecurity and create a Security Policy rule for each Advanced IP Defense EDL you want to enforce.
      For each rule:
      • In the Source or Destination tab, click Add and select the Advanced IP Defense EDL. Use the Source Address field to match inbound traffic from malicious IPs, or the Destination Address field to match outbound traffic to malicious IPs.
      • In the Actions tab, set the action to Deny (block and drop) or Allow with logging enabled (alert-only mode for initial monitoring).
      • In the Actions tab, enable Log at Session End and attach a log forwarding profile to forward matches to your SIEM or Strata Logging Service.
      Position the Advanced IP Defense EDL rules before your general allow rules in the policy rulebase to ensure they are evaluated first. See Security Policy for more information about rule ordering and evaluation.
    5. Commit your changes.
    6. Select MonitorLogsTraffic to view logs for traffic that matched the Advanced IP Defense EDL rules.
      Filter by the rule name or use the destination/source EDL columns to identify which EDL triggered the match.
    The Advanced IP Defense EDLs are updated with each content package release. Schedule automatic content updates to ensure your EDLs reflect the latest threat intelligence. On PAN-OS 12.2.3 and later, you can also enable the full Advanced IP Defense profile-based architecture for granular attribute-level matching, direct-to-IP detection, and real-time cloud lookups. The predefined EDLs remain available alongside profile-based controls.
    When you upgrade from an earlier PAN-OS release to 12.2.3 or later, your existing Advanced IP Defense predefined EDLs and the security policy rules that reference them remain intact. You do not need to reconfigure EDL-based policies after the upgrade. You can continue using the EDLs for IP-based blocking while you evaluate and deploy the full profile-based controls.

    © 2026 Palo Alto Networks, Inc. All rights reserved.