Blocking Attacker Infrastructure at the Network Layer: Introducing Advanced IP Defense

Threat actors are increasingly exploiting network-layer blind spots to bypass traditional security controls. By establishing direct-to-IP connections for outbound command-and-control (C2) traffic—skipping DNS entirely—or using anonymizers like commercial VPNs and residential proxies for inbound reconnaissance, attackers easily circumvent web security and static threat feeds.

In this product-focused session, we introduce Advanced IP Defense, a new inline threat protection service within the Palo Alto Networks Cloud-Delivered Security Services (CDSS) suite. Through live Strata Cloud Manager demonstrations, we will walk through how to configure outbound Zero-Trust IP rules and inbound anonymizer protections to block malicious attacker infrastructure in real time—stopping threats earlier in the kill chain without requiring decryption.

Key Takeaways:

• Stop Outbound Direct-to-IP Evasion: See how Zero-Trust IP checks the firewall's local DNS State Table to verify preceding domain lookups, instantly dropping unverified direct-to-IP C2 traffic hosted on shared public cloud infrastructure.
• Block Inbound Reconnaissance: Learn how attaching Advanced IP Defense profiles to internet-facing Untrust zones automatically identifies and drops automated port scans coming from commercial VPNs and anonymizers.
• Overcome Threat Feed Bottlenecks: Discover how replacing static blocklists with continuous context (evaluating 40+ security attributes) eliminates firewall memory limits and prevents SOC noise while preserving legitimate business traffic.

Speakers:

• Huzefa Amreliwala, Senior Product Manager, CDSS
• Anish Sharma, Technical Marketing Engineer, CDSS

Event Recording: This session will be recorded and made available on LIVEcommunity after the event along with any presentation materials.

Connectivity Issues: If you have any problems connecting to this session, please be sure any VPN connection you have is disconnected/dropped. We've encountered this a couple times in the last and this has always taken care of it.

Any questions, please reach out to Fuel HQ at fuel@fuelusergroup.org.