Best Training to Perform Automated Blocks of Malicious IPs

[Luis1980]

Hello everyone. My security group wants to perform more automated blocks when they report malicious IPs, Now we are in the way they send us IPs and block them in the Internet Outbound Firewall cluster. But they want to automate this. I've been reading about SAM rules, but I don't know if it's the best way or if anyone knows about this and can help me. Or if there are other better ways to block IPS. My version is GAIA R80.40.

Thankss.

[Sorin_Gogean]

Have a look here, as you are not on R81.

If you were in R81, then I would recommend you to go with Generic DataCenter Objects (SK167210 ),

[_Val_]

Generic DataCenter object all the way, which means, you want to upgrade to the recommended version.

[_Val_]

Admin note: moved to the appropriate space.

[the_rock]

Guys are correct 100%. I would suggest you go to R81.10 if you can, super stable version. Personally, I find mgmt server works really well on R81.20, but would wait for gateway on that version, at least until some jumbo hotfixes come out.

Cheers,

Andy

[Luis1980]

You recommend this to use the datacenter objects.

Would I have to upload the MGMT and all the Firewalls we have?

Thank you.

[the_rock]

Only mgmt, you can import that anywhere except smart console.