External blocklist – Policy
You can use the external blocklist (threat feed) for web filtering, DNS, and in firewall policies.
In this example, an IP address blocklist connector is created so that it can be used in a firewall policy.
To configure an external block list connector in the GUI:
- Go to Security Fabric > External Connectors and click Create New.
- In the Threat Feeds section, click IP Address.
- Set Name to AWS_IP_Blocklist.
- Set the URI of external resource to https://s3.us-east-2.amazonaws.com/ip-blocklist/ip.txt.
- Configure the remaining settings as required, then click OK.
- Edit the connector, then click View Entries to view the IP addresses in the feed.
The blocklist can now be used in web filter and DNS profiles, and in firewall policies.
To configure an external block list connector in the CLI:
config system external-resource edit "AWS_IP_Blocklist" set status enable set type address set username ' ' set password ********* set comments '' set resource "https://s3.us-east-2.amazonaws.com/ip-blocklist/ip.txt" set refresh-rate 15 next end
To apply an external block list to a firewall policy in the CLI:
config firewall policy edit 1 set name "policyid-1" set srcintf "wan2" set dstintf "wan1" set srcaddr "all" set dstaddr "AWS_IP_Blocklist" set action accept set schedule "always" set service "ALL" set logtraffic all set auto-asic-offload disable set nat enable next end