Palo Alto Networks (PAN-OS)

Use the list as an External Dynamic List and block it in a security policy.

PAN-OS firewalls can pull a list of addresses from a URL as an External Dynamic List (EDL) and use it like any address object. Point an EDL at the plain-text blocklist and deny it at the top of your rulebase.

Set it up

Go to Objects › External Dynamic Lists and click Add.
Set Name to isipsafe, Type to IP List, and Source to:
```
https://isipsafe.com/api/v1/blocklist?key=sl_your_key_here&format=txt&confidenceMinimum=90&limit=50000
```
Set Check for updates to Hourly. Use Test Source URL to confirm the firewall can reach it, then save.
Go to Policies › Security and add a rule above your allow rules: Source Zone your untrust zone, Source Address isipsafe, Destination any, Action Deny (or Drop). Add a second rule with the EDL as Destination Address to stop infected inside hosts calling out to listed addresses.
Commit. Check the entries under the EDL with List Entries and Exceptions, or from the CLI with request system external-list show type ip name isipsafe.

Sizing

How many addresses an EDL may hold depends on the model and PAN-OS version (tens of thousands on small appliances, more on larger ones). Set limit in the URL to fit, and raise confidenceMinimum if you need to keep the list short: the highest-confidence addresses come first.

Panorama: create the EDL in a device group and push it; each firewall fetches the list itself, so they all need to reach isipsafe.com.

Need a hand?

If something here does not work with your version of Palo Alto Networks (PAN-OS), or you have improved it, tell us. We update these pages with what people send.

Palo Alto Networks (PAN-OS) and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.