>
    Enforce Policy on an External Dynamic List
    Focus
    Download PDF
    Focus
    1. Home
    2. Network Security
    3. Network Security: Security Policy
    4. Policy Objects
    5. Policy Object: External Dynamic Lists
    6. Enforce Policy on an External Dynamic List
    Download PDF
    Network Security

    Enforce Policy on an External Dynamic List

    Table of Contents

    Enforce Policy on an External Dynamic List

    Learn how to block or allow traffic based on IP addresses or URLs in an external dynamic list, or use a dynamic domain list with a DNS sinkhole to prevent access to malicious domains.
    Where Can I Use This?
    What Do I Need?
    • NGFW (Cloud Managed)
    • NGFW (PAN-OS & Panorama Managed)
    • Prisma Access (Cloud Management)
    • Prisma Access (Panorama Managed)
    Check for any license or role requirements for the products you're using.
    External Dynamic Lists allow you to dynamically update security rules based on real-time threat intelligence obtained from external sources. This dynamic integration ensures that your configuration remains updated with the latest threat indicators, allowing for a proactive and effective response to emerging cyberthreats.
    To get started, you'll need to configure and external dynamic list. This involves providing essential information such as the external dynamic list's URL, type (IPv4, IPv6, domain, etc.), and any necessary authentication credentials. Your configuration regularly fetches and updates this information to stay current with the evolving threat landscape.
    Once you've configured your external dynamic list, you can integrate it into your security rules. Your configuration references your external dynamic list in relevant rule conditions, and uses the external threat indicators to match traffic. For example, an external dynamic list containing malicious IP addresses can be referenced in a security rule to block traffic originating from or destined to those addresses.
    It’s important for your configuration to be able to dynamically update and enforce security rules based on the contents of the external dynamic list. This ability significantly enhances your configuration's efficacy in detecting and preventing potential threats by applying up to date threat intelligence from trusted sources.
    Regular monitoring and maintenance are crucial aspects of this process. Routinely review the external dynamic list configuration, validate its accuracy and relevance, and fine-tune security rules based on the intelligence gathered. Adjustments might include modifying rules to block or allow traffic based on the latest threat indicators or updating the external dynamic list to align with changing security needs.
    Leveraging an external dynamic list to enforce Security policy represents a proactive and agile approach to cybersecurity. It allows you to adapt swiftly to evolving threats, fortifying your network defenses and ensuring a robust security posture.
    Follow these steps to block or allow traffic based on IP addresses or URLs in an external dynamic list, or use a dynamic domain list with a DNS sinkhole to prevent access to malicious domains.

    Cloud Managed

    Block or allow traffic based on IP addresses or URLs in an external dynamic list, or use a dynamic domain list with a DNS sinkhole to prevent access to malicious domains.
    Block or allow traffic based on IP addresses or URLs in an external dynamic list, or use a dynamic domain list with a DNS sinkhole to prevent access to malicious domains.
    Tips for enforcing policy with external dynamic lists:
    • Search for a domain, IP address, or URL that belongs to one or more external dynamic lists is used in policy. This is useful for determining which external dynamic list (referenced in a Security rule) is causing a certain domain, IP address, or URL to be blocked or allowed.
    • Use an External Dynamic List of Type URL as Match Criteria in a Security Security Rule.
      1. Select
        Manage
        Configuration
        NGFW and
        Prisma Access
        Security Services
        Security Policy
        .
      2. Select
        Add Rule
         and enter a descriptive
        Name
         for the rule.
      3. In
        SOURCE
        , select a
        Zone
        .
      4. In
        DESTINATION
        , select a
        Zone
        .
      5. In
        URL CATEGORY / TENANT RESTRICTION
        , select the appropriate external dynamic list from the URL Category list.
      6. In
        Actions
        , set the
        Action
         setting to
        Allow
         or
        Deny
        .
      7. Select
        Save
        .
      8. Verify whether entries in the external dynamic list were ignored or skipped.
      9. Test that the policy action is enforced.
        1. View External Dynamic List Entries for the URL list, and attempt to access a URL from the list.
        2. Verify that the action you defined is enforced.
        3. Monitor activity. Select
          Incidents & Alerts
          Log Viewer
          Firewall/URL
           to access the detailed log view.
    • Use an IP External Dynamic List or Predefined IP External Dynamic List as a Source or Destination Address Object in a Security Rule.
      This capability is useful if you deploy new servers and want to allow access to the newly deployed servers without requiring a commit.
      1. Select
        Manage
        Configuration
        NGFW and
        Prisma Access
        Security Services
        Security Policy
        .
      2. Select
        Add Rule
         and give the rule a descriptive
        Name
        .
      3. In
        SOURCE
         and
        DESTINATION
        , set the external dynamic list to be used as the
        SOURCE
         and
        DESTINATION
         addresses.
      4. In
        APPLICATION / SERVICE
        , make sure the
        Service
         is set to
        Application Default
        .
      5. In
        Actions
         set the
        Action
        setting to
        Allow
         or
        Deny
        .
        Create separate external dynamic lists if you want to specify allow and deny actions for specific IP addresses.
      6. Leave all the other options at the default values.
      7. Select
        Save
         to save the changes.
      8. Test that the policy action is enforced.
        1. View External Dynamic List Entries for the external dynamic list, and attempt to access an IP address from the list.
        2. Verify that the action you defined is enforced.
        3. Select
          Incidents & Alerts
          Log Viewer
          Firewall/Traffic
           and view the log entry for the session.
    • Use a Predefined URL External Dynamic List to exclude benign domains that applications use for background traffic from Authentication policy.
      When you select the
      panw-auth-portal-exclude-list
       EDL type, you can easily exclude from Authentication policy enforcement the domains that many applications use for background traffic, such as updates and other trusted services. This ensures that the necessary traffic for these services is not blocked and application maintenance is not interrupted.
      1. Select
        Manage
        Configuration
        NGFW and
        Prisma Access
        Identity Services
        Authentication
        Authentication Rules
        Add Rule
        .
      2. In
        Services and URLs
        , select the Predefined URL EDL as the
        URL Category
        .
      3. In
        Action
        , select
        Do Not Authenticate
        .
      4. Select
        Save
        .
      5. Move
         the rule to the top so that it's the first rule in the policy.

    PAN-OS & Panorama

    Learn how to block or allow traffic based on IP addresses or URLs in an external dynamic list, or use a dynamic domain list with a DNS sinkhole to prevent access to malicious domains.
    Block or allow traffic based on IP addresses or URLs in an external dynamic list, or use a dynamic domain list with a DNS sinkhole to prevent access to malicious domains.
    Tips for enforcing policy on the firewall with external dynamic lists:
    • When viewing external dynamic lists on the firewall (
      Objects
      External Dynamic Lists
      ), click
      List Capacities
       to compare how many IP addresses, domains, and URLs are currently used in policy with the total number of entries that the firewall supports for each list type.
    • Use Global Find to Search the Firewall or Panorama Management Server for a domain, IP address, or URL that belongs to one or more external dynamic lists is used in policy. This is useful for determining which external dynamic list (referenced in a Security policy rule) is causing the firewall to block or allow a certain domain, IP address, or URL.
    • Use the directional controls at the bottom of the page to change the evaluation order of EDLs. This allows you to or order the lists to make sure the most important entries in an EDL are committed before capacity limits are reached.
      You can only change the EDL order when
      Group By Type
       is deselected.
    • Use an External Dynamic List of Type URL as Match Criteria in a Security Security Rule.
      1. Select
        Policies
        Security
        .
      2. Click
        Add
         and enter a descriptive
        Name
         for the rule.
      3. In the
        Source
         tab, select the
        Source Zone
        .
      4. In the
        Destination
         tab, select the
        Destination Zone
        .
      5. In the
        Service/URL Category
         tab, click
        Add
         to select the appropriate external dynamic list from the URL Category list.
      6. In the
        Actions
         tab, set the
        Action Setting
         to
        Allow
         or
        Deny
        .
      7. Click
        OK
         and
        Commit
        .
      8. Verify whether entries in the external dynamic list were ignored or skipped.
        Use the following CLI command on a firewall to review the details for a list.
        request
system external-list show type 
        <domain
         | 
        ip
         | 
        url> name_of_list
        For example:
        request system
external-list show type url EBL_ISAC_Alert_List
      9. Test that the policy action is enforced.
        1. View External Dynamic List Entries for the URL list, and attempt to access a URL from the list.
        2. Verify that the action you defined is enforced.
        3. To monitor the activity on the firewall:
          • Select
            ACC
             and add a URL Domain as a global filter to view the Network Activity and Blocked Activity for the URL you accessed.
          • Select
            Monitor
            Logs
            URL Filtering
             to access the detailed log view.
    • Use an IP External Dynamic List or Predefined IP External Dynamic List as a Source or Destination Address Object in a Security Rule.
      This capability is useful if you deploy new servers and want to allow access to the newly deployed servers without requiring a firewall commit.
      1. Select
        Policies
        Security
        .
      2. Click
        Add
         and give the rule a descriptive
        Name
        .
      3. In the
        Source/Destination
         tabs, set the external dynamic list to be used as the
        Source/Destination Address
        (es).
      4. In the Service/ URL Category tab, make sure the
        Service
         is set to
        application-default
        .
      5. In the Actions tab, set the Action Setting to
        Allow
         or
        Deny
        .
        Create separate external dynamic lists if you want to specify allow and deny actions for specific IP addresses.
      6. Leave all the other options at the default values.
      7. Click
        OK
         to save the changes.
      8. Commit
         the changes.
      9. Test that the policy action is enforced.
        1. View External Dynamic List Entries for the external dynamic list, and attempt to access an IP address from the list.
        2. Verify that the action you defined is enforced.
        3. Select
          Monitor
          Logs
          Traffic
           and view the log entry for the session.
        4. To verify the security rule that matches a flow, select
          Device
          Troubleshooting
          , and execute a Security Policy Match test:
    • Use a Predefined URL External Dynamic List to exclude benign domains that applications use for background traffic from Authentication policy.
      When you select the
      panw-auth-portal-exclude-list
       EDL type, you can easily exclude from Authentication policy enforcement the domains that many applications use for background traffic, such as updates and other trusted services. This ensures that the firewall does not block the necessary traffic for these services and application maintenance is not interrupted.
      1. Select
        Policies
        Authentication
        .
      2. On the
        Service/URL Category
         tab, select the Predefined URL EDL as the
        URL Category
        .
      3. On the
        Actions
         tab, select
        default-no-captive-portal
         as the
        Authentication Enforcement
        .
      4. Click
        OK
        .
      5. Move
         the rule to the top so that it's the first rule in the policy.
      6. Commit
         your changes.

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.