Network feed - exceptions / white list

[Emil_T]

Hi

Is there a white list mechanism available within the Network feed feature to avoid accidental blocking of internal network IPs? The Custom Intelligence (IoC) Feeds automatically excludes private IP ranges, but I haven't found a similar safeguard for the Network feed.

Thx

[the_rock]

Never seen one, but will check in the lab tomorrow.

Andy

[the_rock · Accepted solution]

Just confirmed in the lab, does not appear exceptions are possible.

Andy

[Ted_Serreyn]

While whitelist is NOT directly available as part of the network feed itself, you can correctly implement this with layers to accomplish what you want.

Create a new layer that is executed before your normal policy.   The default for this layer should be to allow all traffic and don’t log it.

Create a whitelist rule to explicity allow the traffic in desired directions, log or don’t to show it was allowed.

Create a network feed rules after this rule to block traffic in desired directions, log or don’t to show it was blocked.

This layer is executed first and “falls thru” to the network policy for additional inforcement.

This layered method does process the accepted packets twice, but presumably you are attempting to block lots of bad actors/ip addresses and really don’t need to process them thru the whole security policy.

Personally we turn off logging on these after testing them to make sure that they are not blocking unexpected networks like VPN or private internal addresses.  If they do, we can put them into the whitelist.

Ted Serreyn

[the_rock]

Definitely good way to go about it, agree.

Andy