{"id":297,"date":"2019-10-03T15:59:24","date_gmt":"2019-10-03T13:59:24","guid":{"rendered":"http:\/\/wp.12p.no\/?p=297"},"modified":"2019-10-03T15:59:24","modified_gmt":"2019-10-03T13:59:24","slug":"blocking-malicius-ips-automaticly-with-palo-alto-firewalls","status":"publish","type":"post","link":"https:\/\/12p.no\/wp\/?p=297","title":{"rendered":"Blocking malicius IP&#8217;s automaticly with Palo Alto Firewalls"},"content":{"rendered":"\n<p>So I&#8217;ve been thinking of creating a post of how to block ips when they try to do something bad to your system, for example a exploit related to a wordpress plugin on your dmz-webserver. It&#8217;s quite easy and extremely effective. Just setup a profile that will automaticly block the ip when it tries to do bad things.<\/p>\n\n\n\n<p>So first of all, create a TAG. Name it something related to blocked-ips<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"http:\/\/wp.12p.no\/wp-content\/uploads\/2019\/10\/image.png\" alt=\"\" class=\"wp-image-298\"\/><\/figure>\n\n\n\n<p>Create a Dynamic type Address Group for this TAG:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"http:\/\/wp.12p.no\/wp-content\/uploads\/2019\/10\/image-4.png\" alt=\"\" class=\"wp-image-302\"\/><\/figure>\n\n\n\n<p>Then create a LogForwarding profile:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"http:\/\/wp.12p.no\/wp-content\/uploads\/2019\/10\/image-1.png\" alt=\"\" class=\"wp-image-299\"\/><figcaption>I chose 1440 mins timeout, so that they will be blocked for excatly 1 day.<\/figcaption><\/figure>\n\n\n\n<p>The result should be something like this:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"http:\/\/wp.12p.no\/wp-content\/uploads\/2019\/10\/image-2.png\" alt=\"\" class=\"wp-image-300\"\/><figcaption><br><\/figcaption><\/figure>\n\n\n\n<p>You now have a setup that matches the severity Cirtical of the logtype Threat, that adds the sourceip of the traffic-log to the BLOCKED-HOSTS tag.<\/p>\n\n\n\n<p>Now you can use your own incomming rule and add this log-forwarding profile to it. (BE SURE that you have a threat profile active on the rule)<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"http:\/\/wp.12p.no\/wp-content\/uploads\/2019\/10\/image-3-1024x355.png\" alt=\"\" class=\"wp-image-301\"\/><\/figure>\n\n\n\n<p>To block these IP&#8217;s you need to create a Rule above the inbound rule to block these IPs:<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"http:\/\/wp.12p.no\/wp-content\/uploads\/2019\/10\/image-5-1024x148.png\" alt=\"\" class=\"wp-image-303\"\/><figcaption><br><\/figcaption><\/figure>\n\n\n\n<p>And you are good to go. Get rid of those idiots (for a selected time atleast)<\/p>\n","protected":false},"excerpt":{"rendered":"<p>So I&#8217;ve been thinking of creating a post of how to block ips when they try to do something bad to your system, for example a exploit related to a wordpress plugin on your dmz-webserver. It&#8217;s quite easy and extremely effective. Just setup a profile that will automaticly block the ip when it tries to [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-297","post","type-post","status-publish","format-standard","hentry","category-it-security"],"_links":{"self":[{"href":"https:\/\/12p.no\/wp\/index.php?rest_route=\/wp\/v2\/posts\/297","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/12p.no\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/12p.no\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/12p.no\/wp\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/12p.no\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=297"}],"version-history":[{"count":0,"href":"https:\/\/12p.no\/wp\/index.php?rest_route=\/wp\/v2\/posts\/297\/revisions"}],"wp:attachment":[{"href":"https:\/\/12p.no\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=297"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/12p.no\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=297"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/12p.no\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=297"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}