Built-In External Dynamic List for Bulletproof Hosts

Because bulletproof hosting providers place few, if any, restrictions on content, attackers frequently use these services to host and distribute malicious, illegal, and unethical material. A Threat Prevention subscription now includes a new built-in external dynamic list (EDL) that you can use to block IP addresses supplied by a bulletproof hosting provider.

Daily antivirus content updates refresh the list, and the latest version of the list replaces the older version. Because the bulletproof host list is built-in to the firewall, you cannot modify its contents. However, if you’d like to exclude certain list entries or add to the list, you can create a new external dynamic list that uses the bulletproof host list as a source.

To start blocking malicious hosts that use bulletproof hosting providers:

1. Confirm that the firewall can access and update the bulletproof host external dynamic list:
   • Confirm that your Threat Prevention subscription license is active (select DeviceLicenses).
   • Confirm that the latest Antivirus and Applications and Threats content updates are installed (DeviceDynamic Updates).
2. View bulletproof IP address list contents:
   1. Select ObjectsExternal Dynamic Lists.
   2. Under Dynamic IP Lists, select Palo Alto Networks - Bulletproof IP addresses and then select List Entries and Exceptions. You cannot modify the contents of this list.

   

3. You can exclude or add list entries by using the bulletproof IP address list as a source for a new list (you cannot directly modify the bulletproof IP address list contents):
   1. Add a new external dynamic list.
   2. Set the list Type to Predefined IP List.
   3. Add the bulletproof IP address list as the Source for the new list.

      

4. To block hosts that use bulletproof hosts to provide malicious, illegal, and/or unethical content, use the bulletproof IP address list in policy.
   1. Select PoliciesSecurity.
   2. Add or modify a security policy rule.
   3. In the Source/Destination tabs, select the bulletproof IP address list to be used as the policy rule Source/Destination Address.
   4. Set the rule Action to Deny.
5. To test the policy rule action:
   1. View the list contents and attempt to access one of the IP addresses in the list.
   2. Verify that the policy action you defined is enforced.
   3. Select MonitorLogsTraffic to view the log entry for the session.