Connect Q-Feeds to SonicWall

Create your API key in the portal. See Get your threat feeds. SonicWall memory limits require a low limit (set to 2000 in this guide). Q-Feeds refreshes every 20 minutes; a 15-minute SonicWall poll may occasionally run with no new data.

Available feed for SonicWall

SonicWall Dynamic Botnet List uses the malware IP feed:

https://api.qfeeds.com/api?feed_type=malware_ips&api_token=YOUR_TOKEN&limit=2000

Test with:

curl -v -u api_token:YOUR_TOKEN "https://api.qfeeds.com/api?feed_type=malware_ips&limit=2000"

Configure the Dynamic Botnet List Server

Go to MANAGE > Security Configuration > Security Services > Botnet Filter.
Open Dynamic Botnet List Server.
Enable Enable Botnet list Download periodically.
Set the update interval to 15 minutes (or the closest supported value).
Set Protocol to HTTPS.
Set URL name to api.qfeeds.com/api?feed_type=malware_ips&limit=2000 (adjust feed type if your portal URL differs; keep limit=2000).
Login ID: api_token.
Password: your Q-Feeds API key.

From SonicOS 6.5.2, username and password for HTTP(S) dynamic Botnet URLs are sent in the HTTP header.

View the downloaded list

Stay on Botnet Filter and open the Dynamic Botnet List tab.
Select Download to pull immediately, or wait for the scheduled interval.
IPs from the list appear on this page. You can Flush entries if needed.
Use the status control next to Flush to see required features and the next download time if something fails.

When Dynamic Botnet List Server is configured, SonicWall checks this list first; if there is no match it falls back to the SonicWall Botnet database.

Apply Botnet filtering on access rules

Example: protect a mail server with Botnet filtering while other traffic is not scanned by this service. Adjust objects and zones to your network.

SonicOS 7.x

Create an Address Object for the mail server: OBJECT > Match Objects > Addresses > Add, enter the IP, save.
Go to POLICY > Security Services > Botnet filter. Enable Block connections to/from Botnet Command and Control Servers based on Firewall Rule-based Connections and Enable Logging, then accept/save.
Create an Access Rule (POLICY > Rules and Policies > Access Rules > Add), for example LAN to WAN for the mail server. Under Security Profiles enable BOTNET / CC, then add/save the rule.

SonicOS 6.5

Create an Address Object: Manage > Objects > Address Objects > Add.
Go to MANAGE > Security Services > Botnet filter. Enable rule-based Botnet C&C blocking and logging, then accept.
Create an Access Rule under MANAGE > Rules > Access Rules. Under Security Profiles enable BOTNET / CC.

Download the PDF manual