External blocklist – Policy

You can use the external blocklist (threat feed) for web filtering, DNS, and in firewall policies.

Sample configuration

In this example, an IP address blocklist connector is created so that it can be used in a firewall policy.

To configure an external block list connector in the GUI:

1. Go to Security Fabric > External Connectors and click Create New.
2. In the Threat Feeds section, click IP Address.
3. Set Name to AWS_IP_Blocklist.
4. Set the URI of external resource to https://s3.us-east-2.amazonaws.com/ip-blocklist/ip.txt.

   

5. Configure the remaining settings as required, then click OK.
6. Edit the connector, then click View Entries to view the IP addresses in the feed.

   

   The blocklist can now be used in web filter and DNS profiles, and in firewall policies.

To configure an external block list connector in the CLI:

config system external-resource
   edit "AWS_IP_Blocklist"
      set status enable
      set type address
      set username ' '
      set password *********
      set comments ''
      set resource "https://s3.us-east-2.amazonaws.com/ip-blocklist/ip.txt"
      set refresh-rate 15
   next
end

To apply an external block list to a firewall policy in the CLI:

config firewall policy
   edit 1
      set name "policyid-1"
      set srcintf "wan2"
      set dstintf "wan1"
      set srcaddr "all"
      set dstaddr "AWS_IP_Blocklist"
      set action accept
      set schedule "always"
      set service "ALL"
      set logtraffic all
      set auto-asic-offload disable
      set nat enable
   next
end