>
    Strata Copilot
    Objects > Security Profiles > Advanced IP Defense
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. PAN-OS Web Interface Help
    4. Objects
    5. Objects > Security Profiles > Advanced IP Defense
    Download PDF
    Next-Generation Firewall

    Objects > Security Profiles > Advanced IP Defense

    Table of Contents

    Objects > Security Profiles > Advanced IP Defense

    Create and manage Advanced IP Defense profiles to inspect traffic based on dynamic IP attributes and direct-to-IP detection.
    Advanced IP Defense is a cloud-delivered security service that provides real-time, context-aware IP address inspection and enforcement. It closes a critical security gap by protecting against threats that bypass traditional DNS and URL-based controls by operating directly at the IP layer. Each profile can have match rules that evaluate traffic against dynamic IP attributes and direct-to-IP detection criteria. You attach the profile to a security zone to enforce policies on traffic entering that zone.
    The firewall maintains a local cache of IP attributes and DNS resolution history to minimize cloud lookups and reduce latency. When a cache miss occurs, the firewall allows the initial session to pass (fail-open) and asynchronously queries the Advanced IP Defense cloud service for a verdict. Once the cloud responds, the local cache is populated and the policy is enforced on all subsequent sessions matching that IP.
    A default profile ships with the content update package and contains predefined match rules for the most common use cases with the action set to alert. You can clone the default profile to create custom profiles tailored to your security requirements.
    The following tables describe the Advanced IP Defense profile settings:
    Advanced IP Defense Profile Settings
    Description
    Name
    Enter a profile name (up to 31 characters). This name appears in the list of Advanced IP Defense profiles when configuring security zones. The name is case-sensitive and must be unique. Use only letters, numbers, spaces, hyphens, periods, and underscores.
    Description
    Enter a description for the profile (up to 255 characters).
    IP Match Field
    Select whether the profile evaluates the source IP or destination IP of each session.
    • Source IP—Evaluate the source IP address to detect inbound threats from known malicious infrastructure.
    • Destination IP—Evaluate the destination IP address to detect outbound connections to C2 servers, anonymizers, or compromised hosts.
    Shared (Panorama only)
    Select this option if you want the profile to be available to:
    • Every virtual system (vsys) on a multi-vsys firewall. If you clear this selection, the profile is available only to the Virtual System selected in the Objects tab.
    • Every device group on Panorama. If you clear this selection, the profile is available only to the Device Group selected in the Objects tab.
    Disable override (Panorama only)
    Select this option to prevent administrators from overriding the settings of this Advanced IP Defense profile in device groups that inherit the profile. This selection is cleared by default, which means administrators can override the settings for any device group that inherits the profile.
    Rules Tab
    Rules define the match criteria and enforcement action for traffic that the firewall evaluates against IP attributes and direct-to-IP detection. Rules are evaluated top-down — the first matching rule determines the action.
    Rule Name
    Specify a name to identify the rule.
    Match Criteria
    Select one or more IP attribute categories or individual tags within a category. Each rule uses either a Match or Does not Match operator to define how traffic is evaluated:
    • Match—Traffic must match the specified criteria. When a single rule has two or more conditions, traffic must match all conditions (AND logic). When a single condition contains multiple tags, traffic must match any one of the tags (OR logic). To create OR logic across different categories, use separate rules.
    • Does not Match—Traffic must not match the specified criterion (NOT logic).
    The following constraints apply to match criteria:
    • You can match by an entire category or by individual tags within a category, but not both in the same rule.
    • The Direct to IP (No-DNS) category has no individual tags. When you select it, the rule evaluates whether the connection occurred without a preceding DNS resolution.
    • The Association category supports tag-based matching only. You must specify individual tags (such as AWS Cloud, GCP Cloud, or CDN) rather than matching the entire category.
    As you build conditions, a summary of the match logic displays above the conditions table. After you save the rule, this summary also appears in the Match Criteria column of the rules list so you can review rule logic without opening each rule individually.
    Action
    Choose the action to take when traffic matches the rule:
    • Allow (Permit)—Allow the traffic to pass without logging.
    • Alert (Permit and Log)—Log the match and allow the traffic to pass.
    • Block (Drop & Log)—Log the match and drop the traffic.
    • Deny (Drop)—Drop the traffic without logging.
    Start with the Alert action during initial deployment to evaluate detection accuracy before enabling Block. Run the profile in alert mode for at least seven days to identify legitimate traffic patterns and create exceptions before enforcing.
    Log Severity
    Set the severity level to control how the match appears in your threat logs. Choose from Critical, High, Medium, Low, or Informational. Higher severity levels can trigger automated responses through log forwarding profiles.
    Exceptions Tab
    Exceptions exclude specific traffic from Advanced IP Defense policy enforcement. Exceptions are evaluated before policy rules; if a connection matches an exception, the corresponding check is skipped for that connection.
    External Dynamic List (EDL)
    Reference an IP-based EDL to allowlist known-good IP addresses from Advanced IP Defense evaluation. Use EDLs for dynamic infrastructure where IP addresses change frequently (such as your own cloud services or CDN providers). The EDL updates automatically without requiring a commit.
    Apply To
    Select which traffic the exception applies to. Currently only All Traffic is available, which excludes matching IPs from all Advanced IP Defense checks (both IP attribute evaluation and direct-to-IP detection).

    © 2026 Palo Alto Networks, Inc. All rights reserved.