>
    Strata Copilot
    How Advanced IP Defense Works
    Focus
    Download PDF
    Focus
    1. Home
    2. Advanced IP Defense
    3. How Advanced IP Defense Works
    Download PDF
    Advanced IP Defense

    How Advanced IP Defense Works

    Table of Contents

    How Advanced IP Defense Works

    Advanced IP Defense attaches security profiles to zones rather than individual Security policy rules, providing real-time cloud-backed IP inspection across all traffic that crosses a zone boundary.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by Strata Cloud Manager)
    • NGFW (Managed by PAN-OS or Panorama)
    • VM-Series
    • Advanced IP Defense license
    • PAN-OS 11.1 and later
    Advanced IP Defense delivers threat intelligence to your enforcement points in two ways, depending on your PAN-OS version:
    Delivery ModePAN-OS VersionHow It Works
    Profile-based12.2.3 and laterReal-time cloud lookups with zone-attached profiles, direct-to-IP detection, and granular per-category enforcement actions.
    EDL-based
    (Required) 11.1 - 12.2.2
    (Optional) 12.2.3 and later
    		Predefined external dynamic lists delivered through the AV content package. No cloud lookups or profile configuration required.

    Advanced IP Defense Profiles

    An Advanced IP Defense profile is the policy object that defines how the service inspects and responds to IP-based threats. You create a profile, populate it with match rules, and then attach it to one or more security zones where it inspects all traffic crossing the zone boundary.
    Each profile contains one or more match rules. For each rule, you specify:
    • Category — the IP attribute category (such as Malware-C2, Anonymizers, or Direct-to-IP) or individual tags within a category that the rule targets. IP attribute categories are classifications that describe the nature or risk level of an IP address based on real-time cloud intelligence.
    • Action — what happens when traffic matches the rule: Allow (Permit), Alert (Permit and Log), Block (Drop & Log), or Deny (Drop).
    • Log severity — how the match appears in your threat logs.
    When a profile contains multiple rules, they are evaluated sequentially from top to bottom on a first-match-wins basis; processing stops at the first rule that matches. If no rules match, traffic is implicitly allowed.
    Within an individual rule, you can build compound match criteria by combining dynamic IP attribute categories using logical AND, OR, and NOT operators. These operators function as follows:
    • Implicit OR (within a single category clause) — When you select multiple tags under the same attribute category in a single rule clause, the firewall evaluates them with implicit OR logic. Traffic matching any of the specified tags satisfies that condition.
      Example: Anonymizers & Proxies [Tor Exit Node, Open Proxy] matches if the IP is classified as a Tor Exit Node OR an Open Proxy.
    • Logical AND (across different category clauses) — Use the AND operator to link distinct category clauses. The rule triggers only if all joined clauses evaluate to true.
      Example: Association [Content Delivery Network (CDN), Public Cloud] AND Direct-to-IP Detection matches only if the destination IP belongs to a CDN or Public Cloud provider AND the connection was initiated directly without a prior DNS resolution.
    • Logical NOT (negation constraint) — The NOT operator negates a condition to match traffic that does not possess a specific attribute category or tag. You can only configure a single NOT operator containing a single negated category or tag-set per rule. Chaining multiple independent NOT clauses triggers a schema error and causes the policy commit to fail.
      • Supported (single NOT operator block): NOT (Anonymizers & Proxies [Commercial VPN, Tor Exit Node]) — valid because it negates multiple tags inside a single, unified category clause.
      • Not supported (disjoint NOT clauses): NOT (Anonymizers & Proxies [Commercial VPN]) AND Abuse [Scanning and Brute-force] AND NOT (Direct-to-IP Detection) — invalid because it chains multiple, separate NOT operations across different conditions in a single rule.
    The profile also has an IP match field setting that specifies whether rules evaluate the source or destination IP of each session. This setting applies to all rules in the profile.
    Once defined, you attach the profile to one or more security zones. The zone is where enforcement takes effect.

    Zone-Based Enforcement

    A security zone is a grouping of one or more interfaces (physical or virtual) that represents a segment of your network. Traffic flows freely within a zone, but it cannot move between zones without a Security policy rule that explicitly allows it. The more granular your zones, the more control you have over what traffic can reach sensitive applications and data.
    You can associate an Advanced IP Defense profile with one or more zones associated with any number of Security policy rules. The profile then inspects all traffic entering or leaving that zone, regardless of which Security policy rule the traffic matches. This means:
    • Broader coverage — The profile inspects every session that traverses the zone boundary. You do not need to add the profile to every Security policy rule individually.
    • One profile per zone — Each zone supports exactly one Advanced IP Defense profile. If you need different enforcement actions for different network segments, create separate zones with separate profiles.
    • One profile across many zones — You can attach a single profile to multiple zones to apply consistent enforcement across your network.
    • Immediate effect — When you attach a profile to a zone, enforcement begins on the next session that crosses that zone boundary. When you remove a profile, inspection stops immediately.
    Because Advanced IP Defense operates at the zone level, it inspects traffic before and independently of Security policy rule evaluation. This provides a foundational layer of IP reputation enforcement that complements your existing rule-based security policies.

    Traffic Inspection Flow

    When your enforcement point processes a session in a zone that has an Advanced IP Defense profile, the following inspection flow occurs:
    1. Allowlist check — The enforcement point checks whether the destination IP appears on the golden or customized allowlist. If the IP matches an allowlist entry, it bypasses the cloud lookup entirely.
    2. Local cache check — The enforcement point checks its local IP attribute cache. If a valid (non-expired) entry exists, the enforcement point uses the cached verdict to evaluate the session against the profile match rules.
    3. Cloud lookup (asynchronous) — On a cache miss, the enforcement point immediately allows the session to pass (fail-open) and asynchronously sends a query to Advanced IP Defense through the Management Plane. Once the verdict is returned, the local cache is populated and the policy is strictly enforced on all subsequent sessions matching that IP.
    4. Match evaluation — The enforcement point evaluates the returned attributes against the profile match rules. Rules specify an IP attribute category, a tag (or all tags in a category), and an action — Allow (Permit), Alert (Permit and Log), Block (Drop & Log), or Deny (Drop). The enforcement point logs the result and enforces the configured action.
    The default cache-miss behavior is fail-open: the firewall allows the initial session to pass without delaying or dropping it, then enforces the policy on subsequent sessions once the cloud verdict populates the local cache. If a strict security posture is configured to drop traffic on unknown lookups, the firewall drops packets only while Advanced IP Defense is reachable. If Advanced IP Defense becomes unreachable, the firewall reverts to fail-open to prevent a network outage.

    Default Profile

    Advanced IP Defense ships a default profile named default through the content update package. The default profile contains match rules for all available IP attribute categories with every action set to alert. This gives you immediate visibility into IP-based threats without blocking any traffic, allowing you to monitor Advanced IP Defense verdicts and tune your security posture before enforcing block actions.
    You can clone the default profile to create custom profiles with specific match rules and actions tailored to your security requirements. You can also modify the default profile directly, but Palo Alto Networks recommends cloning it first so you always retain the baseline configuration for reference.

    Content Updates

    The PAN-OS content update package delivers the IP attribute categories, tags, and default profile configuration. When Palo Alto Networks introduces new categories or tags, they appear in the security profile configuration after you install the updated content package. This content-driven model means you can adopt new security capabilities without upgrading PAN-OS.
    Advanced IP Defense independently updates its IP classification algorithms and allowlists. Your enforcement point periodically downloads updated allowlists from Advanced IP Defense to keep local allowlist entries current.

    Logging

    Advanced IP Defense generates a dedicated log subtype (aipd) under Threat logs. Each log entry includes the matched IP attribute category, the specific tag that triggered the match, the enforcement action (allow, alert, block, or deny), and the evaluated IP address. You can view Advanced IP Defense logs alongside other threat logs in the PAN-OS web interface, Panorama, or Strata Cloud Manager Log Viewer.

    © 2026 Palo Alto Networks, Inc. All rights reserved.