You can use the external blocklist (threat feed) for web filtering, DNS, and in firewall policies.
In this example, an IP address blocklist connector is created so that it can be used in a firewall policy.
- Go to Security Fabric > External Connectors and click Create New.
- In the Threat Feeds section, click IP Address.
- Set Name to AWS_IP_Blocklist.
- Set the URI of external resource to https://s3.us-east-2.amazonaws.com/ip-blocklist/ip.txt.
- Configure the remaining settings as required, then click OK.
- Edit the connector, then click View Entries to view the IP addresses in the feed.
The blocklist can now be used in web filter and DNS profiles, and in firewall policies.
config system external-resource edit "AWS_IP_Blocklist" set status enable set type address set username '' set password ENC set comments '' set resource "https://s3.us-east-2.amazonaws.com/ip-blocklist/ip.txt" set refresh-rate 15 next end
config firewall policy edit 1 set name "policyid-1" set srcintf "wan2" set dstintf "wan1" set srcaddr "all" set dstaddr "AWS_IP_Blocklist" set action accept set schedule "always" set service "ALL" set logtraffic all set auto-asic-offload disable set nat enable next end