** Blocked Internet Addresses **

< !!! INTERNAL USE ONLY !!! >
Not for distribution directly to end user

Overview

CCBC currently blocks various countries and IP addresses based on legal statutes while others are based on attack posture and previous attacks to the college.  There are two devices that block traffic at the Internet links, the Cisco Firepower network firewalls and the Palo Alto application firewalls.  Each device block or allow traffic differently.  What and how they block are described below along with the specifics of what each system is blocking or allowing.

Audience

ITS Staff

Palto Alto Application Firewalls

The Palto Altos blocks connections based on a country identifier defined in the firewall application.  That application takes the country in the application and does a look up of the IP addresses associated with that country.  If CCBC needs to look up what IP address is associated with which country using the Palto Alto units refer to the following KB article:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHHCA0   

Palto Alto country blocks are currently configured globally within the firewall, which means it gets applied to all rules.  Currently, CCBC blocks the following countries via the Palto Altos:

• Belarus
• China
• Iran
• Russia

Cisco Firepower Network Firewalls

The Cisco Firepower Firewalls work in the opposite manner from the Palo Alto firewalls.  There are a series of IP subnets that have been defined by the American Registy of Internet Numbers (ARIN) as belonging to Canda and the US.  These groups of IP subnets have been defined in the Firepower firewalls and then consolidate into a single group called “US and Canada”.  The group is applied at the rule level, which means that any rule that has this group as the source restricts the entry to those IP addresses.

Note: Not all rules in the Firepower have the Us and Canada group associated with it.

The IP subnets along with the subnet mask they use are provided here: