Built-In External Dynamic List for Bulletproof Hosts

Because bulletproof hosting providers place few, if any, restrictions on content, attackers frequently use these services to host and distribute malicious, illegal, and unethical material. A Threat Prevention subscription now includes a new built-in external dynamic list (EDL) that you can use to block IP addresses supplied by a bulletproof hosting provider.

Daily antivirus content updates refresh the list, and the latest version of the list replaces the older version. Because the bulletproof host list is built-in to the firewall, you cannot modify its contents. However, if you’d like to exclude certain list entries or add to the list, you can create a new external dynamic list that uses the bulletproof host list as a source.

To start blocking malicious hosts that use bulletproof hosting providers:

Confirm that the firewall can access and update the bulletproof host external dynamic list:
Confirm that your Threat Prevention subscription license is active (select
Device
Licenses
).
Confirm that the latest Antivirus and Applications and Threats content updates are installed (
Device
Dynamic Updates
).
View bulletproof IP address list contents:
Select
Objects
External Dynamic Lists
.
Under Dynamic IP Lists, select
Palo Alto Networks - Bulletproof IP addresses
and then select
List Entries and Exceptions
. You cannot modify the contents of this list.

You can exclude or add list entries by using the bulletproof IP address list as a source for a new list (you cannot directly modify the bulletproof IP address list contents):
Add

a new external dynamic list.

Set the list

Type

to

Predefined IP List

.

Add the bulletproof IP address list as the

Source

for the new list.


To block hosts that use bulletproof hosts to provide malicious, illegal, and/or unethical content, use the bulletproof IP address list in policy.
Select
Policies
Security
.
Add
or modify a security policy rule.
In the
Source
/
Destination
tabs, select the bulletproof IP address list to be used as the policy rule
Source
/
Destination Address
.
Set the rule
Action
to
Deny
.
To test the policy rule action:
View the list contents and attempt to access one of the IP addresses in the list.
Verify that the policy action you defined is enforced.
Select
Monitor
Logs
Traffic
to view the log entry for the session.