External Block List (Threat Feed) – Policy

You can use the External Block List (Threat Feed) for web filtering and DNS. You can also use External Block List (Threat Feed) in firewall policies.

Sample configuration

In Security Fabric > Fabric Connectors > Threat Feeds > IP Address, create or edit an external IP list object.

Click View Entries to see the external IP list.

To create an external iplist object using the CLI:

config system external-resource
   edit "test-external-iplist-1"
      set status enable
      set type address
      set username ''
      set password ENC 
      set comments ''
      set resource "http://10.6.30.55/ip_list_test/test-external-iplist-2.txt"
      set refresh-rate 15
   next
end

To apply an external iplist object to the firewall policy using the CLI:

config firewall policy
   edit 1
      set name "policyid-1"
      set srcintf "wan2"
      set dstintf "wan1"
      set srcaddr "all"
      set dstaddr "test-external-iplist-1"
      set action accept
      set schedule "always"
      set service "ALL"
      set logtraffic all
      set auto-asic-offload disable
      set nat enable
   next
end