Adding addresses to existing Network List - Firepower

[ziqex]

Hello everyone,

I would like to add couple of addresses to existing network list.

Once I click edit on the list, I can only delete existing addresses or save the config.

I don't see the add option. Please advise.

Regards,

Daniel

[Rob Ingram]

Hi,
Are you referring to Security Intelligence lists?
You just download the latest list, update it then re-upload the list and deploy.

HTH

[ziqex]

Yes, I refer to Security intelligence , Network lists and feeds.

How can I download the list?

I see following options only: update feeds, add network lists and feeds delete.

Thanks

[Rob Ingram]

You can select the pencil icon to the right of the list, which will open the window below. You can then click download, upload the list in notepad, edit and then re-upload.

If you don't see that, please upload a screenshot.

HTH

[ziqex]

For the global-whitelist I only see the option as per below screenshot. 

I do not know how can I add extra addresses. 

However, for the block list I see the same options as you have. 

Thanks

[Rob Ingram]

You go to connection > events, right click the IP address and then select either Blacklist or Whitelist IP address. The IP address would then appear in the Blacklist or Whitelist you referenced.

Spoiler

[ziqex]

What if the connection has not been ever established to those addresses.

The addresses are not shown in the events.

Regards,

Daniel

[Rob Ingram]

You could just generate some traffic to the address(s), monitor in the connection events and then add to the global whitelist/blacklist.

Or just create a custom list (as per the screenshot I previously providied), that would perhaps allow you the ability to add/remove easier.

[ziqex]

Perfect. I have created and uploaded new list as advised, called White_List.
Do I need to manually add it for policies etc?
If yes how can I check which policies are using the default Global-Whitelist.
Thanks for the advice.

[Rob Ingram · Accepted solution]

Once you've created the Network List, you would need to modify your Access Policy, go to the Security Intelligence tab and then select the list (add to whitelist).

E.g. - custom list called "IP_List" added to Whitelist.

You will also be able to determine whether the Policy is using the Global Whitelist/Blacklists.

[star1]

Hello,

I think you need to do that on the Object - Object Management then find the object you need to modify and click on the pencil icon on the right hand then choose range then save the configuration and go back to policies - access control chose the object and deploy, this should sort the problem.

SS