Enable Advanced IP Defense (PAN-OS 12.2 and Later)

1. Log in to your firewall or Panorama.

   Use your admin credentials to access the web interface.
2. Verify that you have an active Advanced IP Defense license.

   Select DeviceLicenses and verify that the Advanced IP Defense license is available and has not expired.
3. Create or update an Advanced IP Defense profile.

   Select ObjectsSecurity ProfilesAdvanced IP Defense and click Add to create a new profile or select an existing profile to edit.

   Enter a name and description for the profile. You can also select a default profile to use as a template.
4. Configure policy rules within the Advanced IP Defense profile.

   Click Add Rule to create rules that match traffic based on IP attributes or direct-to-IP detection. For each rule, specify:

   • IP Match Field (source IP or destination IP)
   • Match criteria (IP attributes, categories, or NO_DNS for direct-to-IP detection)
   • Action (Allow, Alert, or Block)
   • Log severity level

   You can combine multiple criteria using AND, OR, or NOT operators to create complex rules.
5. Configure exceptions and allowlists.

   Click the Exceptions tab to configure exceptions for known benign traffic. You can add:

   • IP-based exceptions
   • Port-based exceptions
   • IP-port pair exceptions
   • EDL-based exceptions

   Exceptions allow you to bypass Advanced IP Defense checks for specific traffic patterns.
6. Click OK to save the Advanced IP Defense profile.

   The profile is now created and ready to be attached to security zones.
7. Attach the Advanced IP Defense profile to security zones.

   Select NetworkZones and select the zone where you want to enforce Advanced IP Defense policies. In the zone configuration, attach the Advanced IP Defense profile you created.
8. Commit your changes.

   Click Commit to apply the Advanced IP Defense configuration to your firewall.
9. Monitor Advanced IP Defense activity.

   Select MonitorLogsThreat to view logs for traffic that matched Advanced IP Defense rules. You can filter logs by IP attributes, direct-to-IP detection, or specific rules to track blocked threats and validate policy effectiveness.