Connect Q-Feeds to Palo Alto

This guide is for administrators setting up the integration on PAN-OS. It covers the prerequisites, how to create the External Dynamic Lists and how to reference them in a Security policy so malicious traffic is blocked.

Available indicator lists

• Malware IP (feed_type=malware_ip)
• Malware domains (feed_type=malware_domains)
• Phishing URLs (feed_type=phishing_urls)

Example URL (replace placeholders with your values):

https://api.qfeeds.com/api?feed_type=malware_ip&limit=50000

Test with:

curl -v -u api_token:YOUR_TOKEN "https://api.qfeeds.com/api?feed_type=malware_ip&limit=50000"

Service route for External Dynamic Lists

1. Open Device > Setup > Services > Service Route Configuration > Customize.
2. Edit the service External Dynamic Lists so the firewall can reach api.qfeeds.com.

Add an External Dynamic List

1. Go to Objects > External Dynamic Lists and select Add.
2. Enter a clear Name for the list.
3. Set Type to IP, Domain or URL to match the feed. For domain lists you can enable Automatically expand to include subdomains.
4. In Source, paste the feed URL and replace placeholders with your API key and an appropriate limit for your model (see capacity table below).
5. Download the Q-Feeds API certificate PEM from https://api.qfeeds.com/download_cert_PA.php.
6. Create a Certificate Profile, import the downloaded certificate(s) as type Local, and assign the profile to the EDL.
7. Enable Client Authentication. Username is api_token; password is your Q-Feeds API key.
8. Set Check for updates to 20 minutes (or your license interval).
9. Commit. The list appears under Objects > External Dynamic Lists and can be used in security policies.
10. Repeat for each feed type you need (IPs, domains, URLs).

Model capacity limits

Choose a limit that fits your platform. Palo Alto enforces platform-wide totals; when the IP limit is reached the firewall generates a syslog message. Predefined IP lists do not count toward the limit.

• IP addresses: PA-3200 / PA-5200 / PA-7000 series up to 150,000 total; other models up to 50,000 total.
• URL / domain list entry limits (examples):
  • PA-5200 / PA-7000 (with high-capacity NPC): up to 250,000 URL / 4,000,000 domain
  • VM-500 / VM-700: 100,000 URL / 2,000,000 domain
  • PA-850 / PA-820 / PA-3200: 100,000 URL / 1,000,000 domain
  • PA-220 / VM-50 / VM-100: 50,000 URL / 50,000 domain

Consult current Palo Alto documentation for your exact model and PAN-OS version.

Use in policies

Reference the new EDL in security policy source or destination (and related URL/domain controls) so matching traffic is blocked or logged according to your rules.

Download the PDF manual