Enforce Policy on an External Dynamic List

• Configure DNS sinkholing for a custom list of domains.
• Use an external dynamic list in a URL Filtering profile.
• Use an external dynamic list of URL type as match criteria in a Security policy rule.

  1. Select PoliciesSecurity.
  2. Click Add, and enter a descriptive Name for the rule.
  3. In the Source tab, select a Source Zone.
  4. In the Destination tab, select a Destination Zone.
  5. In the Service/URL Category tab, click Add to select an external dynamic list for use as URL Category match criteria.
  6. In the Actions tab, set Action Setting to Allow or Deny.
  7. Click OK, and Commit your changes.
  8. Verify whether entries in the external dynamic list were ignored or skipped.

     Use the following CLI command on a firewall to review the details for a list.

     request
     system external-list show type <domain | ip | url> name_of_list 

     For example:

     request system
     external-list show type url EBL_ISAC_Alert_List

  9. Test that the policy action is enforced.

     1. View external dynamic list entries and attempt to access a URL from the list.
     2. Verify that the action you defined is enforced.
     3. To monitor the activity on the firewall:
        • Select ACC, and add a URL Domain as a global filter to view the Network Activity and Blocked Activity for the URL you accessed.
        • Select MonitorLogsURL Filtering to access the detailed log view.
• Use an external dynamic list of IP address type as a Source or Destination Address Object in a Security policy rule.

  This capability is useful if you deploy new servers and want to allow access to the newly deployed servers without requiring a firewall commit.

  1. Select PoliciesSecurity.
  2. Click Add, and enter a descriptive Name for the rule.
  3. In the Source and Destination tabs, select an external dynamic list for Source Address and Destination Address.
  4. In the Service/URL Category tab, set Service to application-default.
  5. In the Actions tab, set Action Setting to Allow or Deny.

     Create separate external dynamic lists to specify allow and deny actions for specific IP addresses.
  6. Leave all the other options at the default values.
  7. Click OK, and Commit your changes.
  8. Test that the policy action is enforced.

     1. View external dynamic list entries and attempt to access an IP address from the list.
     2. Verify that the defined action is enforced.
     3. Select MonitorLogsTraffic and view the log entry for the session.
     4. To verify the policy rule that matches a flow, select DeviceTroubleshooting, and execute a Security Policy Match test:

• Use a predefined URL external dynamic list to exclude benign domains that applications use for background traffic from Authentication policy.

  When you select the panw-auth-portal-exclude-list external dynamic list type, you can easily exclude from Authentication policy enforcement the domains that many applications use for background traffic, such as updates and other trusted services. This ensures that the firewall does not block the necessary traffic for these services and that application maintenance is not interrupted.

  1. Select PoliciesAuthentication.
  2. In the Service/URL Category tab, select the predefined URL external dynamic list as the URL Category.
  3. In the Actions tab, select default-no-captive-portal as the Authentication Enforcement.
  4. Click OK.
  5. Move the rule to the top so that it's the first rule in the policy.
  6. Commit your changes.