Enforce Policy on an External Dynamic List

• Configure DNS Sinkholing for a List of Custom Domains.
• Use an External Dynamic List in a URL Filtering Profile.
• Use an External Dynamic List of Type URL as Match Criteria in a Security Policy Rule.
  1. Select PoliciesSecurity.
  2. Click Add and enter a descriptive Name for the rule.
  3. In the Source tab, select the Source Zone.
  4. In the Destination tab, select the Destination Zone.
  5. In the Service/URL Category tab, click Add to select the appropriate external dynamic list from the URL Category list.
  6. In the Actions tab, set the Action Setting to Allow or Deny.
  7. Click OK and Commit.
  8. Verify whether entries in the external dynamic list were ignored or skipped.
     Use the following CLI command on a firewall to review the details for a list.

     request
     system external-list show type <domain | ip | url> name_of_list 

     For example:

     request system
     external-list show type url EBL_ISAC_Alert_List

  9. Test that the policy action is enforced.
     1. View External Dynamic List Entries for the URL list, and attempt to access a URL from the list.
     2. Verify that the action you defined is enforced.
     3. To monitor the activity on the firewall:
        • Select ACC and add a URL Domain as a global filter to view the Network Activity and Blocked Activity for the URL you accessed.
        • Select MonitorLogsURL Filtering to access the detailed log view.
• Use an External Dynamic List of Type IP or Predefined IP as a Source or Destination Address Object in a Security Policy Rule.
  This capability is useful if you deploy new servers and want to allow access to the newly deployed servers without requiring a firewall commit.
  1. Select PoliciesSecurity.
  2. Click Add and give the rule a descriptive Name.
  3. In the Source/Destination tabs, set the external dynamic list to be used as the Source/Destination Address(es).
  4. In the Service/ URL Category tab, make sure the Service is set to application-default.
  5. In the Actions tab, set the Action Setting to Allow or Deny.
     Create separate external dynamic lists if you want to specify allow and deny actions for specific IP addresses.
  6. Leave all the other options at the default values.
  7. Click OK to save the changes.
  8. Commit the changes.
  9. Test that the policy action is enforced.
     1. View External Dynamic List Entries for the external dynamic list, and attempt to access an IP address from the list.
     2. Verify that the action you defined is enforced.
     3. Select MonitorLogsTraffic and view the log entry for the session.
     4. To verify the policy rule that matches a flow, select DeviceTroubleshooting, and execute a Security Policy Match test:

     Tips for enforcing policy on the firewall with external dynamic lists:

     • When viewing external dynamic lists on the firewall (ObjectsExternal Dynamic Lists), click List Capacities to compare how many IP addresses, domains, and URLs are currently used in policy with the total number of entries that the firewall supports for each list type.
     • Use Global Find to Search the Firewall or Panorama Management Server for an IP address that belongs to one or more external dynamic lists used in the policy. This is useful for determining which external dynamic list (referenced in a Security policy rule) is causing the firewall to block or allow a certain IP address.
     • Use the directional controls at the bottom of the page to change the evaluation order of EDLs. This allows you to or order the lists to make sure the most important entries in an EDL are committed before capacity limits are reached.
       You can only change the EDL order when Group By Type is deselected.