Built-In External Dynamic List for Bulletproof Hosts
A new built-in external dynamic list (EDL) gives you a way to block bulletproof hosting providers, as attackers frequently use these services to host and distribute malicious, illegal, and unethical content.
Because bulletproof hosting providers place few, if any, restrictions on content, attackers frequently use these services to host and distribute malicious, illegal, and unethical material. A Threat Prevention subscription now includes a new built-in external dynamic list (EDL) that you can use to block IP addresses supplied by a bulletproof hosting provider.
Daily antivirus content updates refresh the list, and the latest version of the list replaces the older version. Because the bulletproof host list is built-in to the firewall, you cannot modify its contents. However, if you’d like to exclude certain list entries or add to the list, you can create a new external dynamic list that uses the bulletproof host list as a source.
To start blocking malicious hosts that use bulletproof hosting providers:
- View bulletproof IP address list contents:
- Select.ObjectsExternal Dynamic Lists
- Under Dynamic IP Lists, selectPalo Alto Networks - Bulletproof IP addressesand then selectList Entries and Exceptions. You cannot modify the contents of this list.
- You can exclude or add list entries by using the bulletproof IP address list as a source for a new list (you cannot directly modify the bulletproof IP address list contents):
- Adda new external dynamic list.
- Set the listTypetoPredefined IP List.
- Add the bulletproof IP address list as theSourcefor the new list.
- To block hosts that use bulletproof hosts to provide malicious, illegal, and/or unethical content, use the bulletproof IP address list in policy.
- Addor modify a security policy rule.
- In theSource/Destinationtabs, select the bulletproof IP address list to be used as the policy ruleSource/Destination Address.
- Set the ruleActiontoDeny.
- To test the policy rule action:
- View the list contents and attempt to access one of the IP addresses in the list.
- Verify that the policy action you defined is enforced.
- Selectto view the log entry for the session.MonitorLogsTraffic
Built-in External Dynamic Lists
Built-in External Dynamic Lists With an active Threat Prevention license, Palo Alto Networks provides built-in IP address EDLs that you can use to protect against ...
Content Inspection Features
Learn about the new content inspection features introduced in PAN-OS 9.0. ...
Step 1: Create Rules Based on Trusted Threat Intelligence S...
Step 1: Create Rules Based on Trusted Threat Intelligence Sources Before you allow and block traffic by application, block traffic from hosts that Palo Alto ...
External Dynamic List
External Dynamic List An External Dynamic List is a text file that is hosted on an external web server so that the firewall can import ...
Content Inspection Features
Describes all the exciting new content inspection capabilities in PAN-OS® 9.0. ...
Dynamic Content Updates
Palo Alto Networks frequently publishes updates to equip the firewall with the latest threat prevention and intelligence. ...
Use an External Dynamic List in Policy
Use an External Dynamic List in Policy An external dynamic list (formerly called dynamic block list) is a text file that you or another source ...
Configure the Firewall to Access an External Dynamic List
Configure the Firewall to Access an External Dynamic List You must establish the connection between the firewall and the source that hosts the external dynamic ...
View External Dynamic List Entries
View External Dynamic List Entries Before you Enforce Policy on an External Dynamic List , you can view the contents of an external dynamic list ...