External Block List (Threat Feed) – Policy
This version extends the External Block List (Threat Feed). In addition to using the External Block List (Threat Feed) for web filtering and DNS, you can use External Block List (Threat Feed) in firewall policies.
This version includes the following new features:
- Policy support for external IP list used as source/destination address.
- Support for IPv4 and IPv6 firewall policy only. ACL, DoS, NAT64, NAT46, shaping, local-in policy are not supported.
- Support for both CLI and GUI.
Sample configuration
In Security Fabric > Fabric Connectors > Threat Feeds > IP Address, create or edit an external IP list object.
Click View Entries to see the external IP list.
To create an external iplist object using the CLI:
config system external-resource edit "test-external-iplist-1" set status enable set type address set username '' set password ENC set comments '' set resource "http://10.6.30.55/ip_list_test/test-external-iplist-2.txt" set refresh-rate 15 next end
To apply an external iplist object to the firewall policy using the CLI:
config firewall policy edit 1 set name "policyid-1" set srcintf "wan2" set dstintf "wan1" set srcaddr "all" set dstaddr "test-external-iplist-1" set action accept set schedule "always" set service "ALL" set logtraffic all set auto-asic-offload disable set nat enable next end