> For the complete documentation index, see [llms.txt](https://docs.vectra.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vectra.ai/configuration/response/lockdown/traffic-lockdown.md). # Traffic Lockdown ## Overview **Traffic Lockdown** is a network-level containment feature that enables Vectra to automatically add compromised host IP addresses to an external blocklist that your firewalls can subscribe to. When a host is added to Traffic Lockdown (manually or automatically), its IP address is published to a plain-text threat feed that integrated firewall devices poll and use to block traffic from that host. This provides a multi-layered containment strategy alongside Host Lockdown and Account Lockdown, allowing you to isolate threats at the network. ### How It Works 1. A host meets lockdown criteria (manual selection or automatic threshold) 2. Vectra adds the host's IP address to the managed blocklist 3. Subscribed firewalls poll the blocklist URL at their configured interval 4. Firewalls retrieve updated IP list and enforce blocking rules 5. Traffic from the locked-down host is blocked at the network perimeter ## Configuration ### Prerequisites * Vectra platform with Traffic Lockdown feature enabled * Firewall(s) that support external threat feed/blocklist consumption * Network connectivity between firewall(s) and Vectra appliance * IP addresses of firewalls that will retrieve the blocklist ### Step 1: Enable Traffic Lockdown 1. Navigate to **Configuration > Response - Traffic Lockdown** 2. Toggle **On** the "Traffic Lockdown of hosts via your firewall" switch ### Step 2: Configure Authorized Firewall IPs The **Authorized Firewall IPs** field controls which IP addresses are permitted to communicate with the Vectra appliance to retrieve the Traffic Lockdown feed. This provides an additional layer of access control to ensure only trusted firewall infrastructure can access the blocklist. **Configuration Options:** **Option 1: Specific Firewall IPs (Recommended for most environments)** * Enter the IP addresses or CIDR ranges of your specific firewalls * Provides tightest security by explicitly allowlisting known firewall management IPs * **Format**: One entry per line * **CIDR supported**: Yes (e.g., `10.0.0.0/24`) * **Maximum entries**: 50 **Example:** ``` 192.168.1.10 10.50.0.0/24 172.16.5.100 ``` **Option 2: Allow All Sources (`0.0.0.0/0`)** Use `0.0.0.0/0` when: * You have an extensive number of firewalls across multiple sites/clouds * Your environment uses internal firewalls or network segmentation to control communications between devices and the Vectra appliance * You manage access control through other means (e.g., VPN, jump hosts, bastion servers) * Firewall IPs are dynamic or frequently change **Example:** ``` 0.0.0.0/0 ``` **Important:** When using `0.0.0.0/0`, ensure your Vectra appliance is protected by other network security controls, as any IP address will be able to retrieve the blocklist URL. The blocklist itself only contains IP addresses and does not expose sensitive configuration data. ### Step 3: Configure Basic Authentication (Optional) The **Basic Authentication** toggle enables optional HTTP Basic Authentication for firewalls retrieving the blocklist. When enabled, firewalls must supply a valid username and password in addition to connecting from an authorized IP. 1. Toggle **On** the "Basic Authentication (optional)" switch 2. Click **+ Generate Credentials** 3. In the **Generate Firewall Credentials** dialog, create access credentials for all firewalls connecting to the IP Block List: * **Create User Name**: 8–32 characters * **Password**: 8–16 characters; must include uppercase, lowercase, numbers, and symbols * **Confirm Password**: re-enter the password 4. Click **Save Credentials** **Note:** Basic Authentication is optional and additive — it does not replace the **Authorized Firewall IPs** access control configured in Step 2. When enabled, firewalls must both connect from an authorized source IP **and** authenticate with the generated credentials. You will need to configure these credentials in your firewall's external feed/EDL connector settings alongside the blocklist URL. ### Step 4: Note the Blocklist URL Copy the **Vectra Managed Plain Text Source IP Block List URL** displayed in the configuration: ``` https:///firewall_mgmt/source_ips ``` You'll need this URL when configuring your firewall's external connector or threat feed subscription. ### Step 5: Configure Automatic Lockdown (Optional) If you want Vectra to automatically lock down hosts that meet certain risk criteria: 1. Toggle **On** the "Enable Automatic Traffic Lockdown" switch 2. Set **Automatically disable hosts for**: Choose duration from dropdown * 1 hour * 2 hours * 4 hours * 8 hours * 12 hours * 24 hours 3. Configure **Urgency Score Threshold for Auto Lockdown**: * Use slider to set minimum urgency score (10-100) * Hosts must meet or exceed this threshold 4. Configure **Importance Level**: * Use slider to set minimum importance level (Low, Medium, High) * Hosts must meet or exceed this level **How Automatic Lockdown Works:** * After saving this configuration, any host that exceeds **all** configured thresholds will be automatically added to Traffic Lockdown for the selected duration * Hosts can be manually re-enabled at any time from the host details page * After the configured duration expires, the host is automatically removed from lockdown ### Step : Save Configuration Click **Save** to apply your Traffic Lockdown settings. ### SIEM Configuration (QUX only, with RUX no action is required) If storing all data in a SIEM then update the syslog output configuration to send Traffic Lockdown logs. This is configured under Settings - Notifications - Syslog Edit the destinations you wish to receive these logs and ensure Traffic Lockdown log type is selected. ## Manual vs Automatic Traffic Lockdown ### Manual Lockdown **When to use:** For immediate containment of specific hosts during active investigations **How to enable:** 1. Navigate to the host details page for the target host 2. Click the **Lock Host** button within the Traffic Lockdown section 3. Specify the duration for how long the address will exist in the block list **Characteristics:** * Immediate effect (when the firewall completes its polling cycle) * Remains in lockdown until selected duration expires or is manually removed by using the Unlock Host button * Best for confirmed threats or ongoing investigations ### Automatic Lockdown **When to use:** For automated response to high-risk hosts **How it works:** * Vectra continuously monitors host urgency scores and importance levels * When a host exceeds **all** configured thresholds (Urgency **AND** Importance), it's automatically added to lockdown * Host is automatically removed after the configured duration expires * Can be manually removed at any time before expiration by using the Unlock Host button **Characteristics:** * Threshold-based triggering * Time-limited containment * Reduces manual intervention for high-volume scenarios * Auto-expires to prevent indefinite blocking of remediated hosts ### IP Address Format Requirements The blocklist feed supports: * ✅ **Single IP addresses** in dotted decimal notation (e.g., `192.168.1.100`) * ✅ **One IP address per line** * ✅ **Fully qualified IPv4 addresses** (all four octets required) The blocklist feed does **NOT** support: * ❌ **CIDR notation** in the feed output (e.g., `10.0.0.0/24`) * ❌ **IP ranges** (e.g., `192.168.1.1-192.168.1.254`) * ❌ **Hostnames or FQDNs** **Note:** While CIDR notation is supported for the **Authorized Firewall IPs** configuration field (to authorize multiple firewalls), the blocklist feed itself only contains individual IP addresses. ### Compatibility The plain-text blocklist format is compatible with: * Palo Alto Networks External Dynamic Lists (EDL) * Fortinet External IP Address objects * Juniper Dynamic Address IP Blocklists * Any firewall vendor supporting text-based external IP lists for source address blocking ## Firewall Configuration Examples *This section includes configuration examples for some common firewalls. This should be used for guidance only. Always refer to your firewall documentation corresponding to the firewall version in use.* ### Fortinet *Fortinet employs an IP Address External Feed to support this capability.* IP Address External Feed\ **User Interface:** 1\. Go to *Security Fabric → External Connectors* and click **Create New**.\ 2\. In the **External Feeds** section, click **IP Address***.*\ 3\. Set the **Name** to `_Vectra_SourceIP_Blocklist_`*.*\ 4\. Set the **Update method** to **External Feed***.*\ 5\. Set the **URL of external resource** to the URL provided in Vectra configuration.\ 6\. Configure the remaining settings as required, then click **OK***.*\ 7\. **Edit** the connector, then click **View Entries** to view the IP addresses in the feed. **Command Line:** ``` config system external-resource edit "_Vectra_SourceIP_Blocklist_" set type address set resource "https:///firewall_mgmt/source_ips" set server-identity-check {none | basic | full} next end ``` Apply this feed as a source in a policy to restrict connectivity as appropriate. In most cases, this would be a policy near the top denying this source group to communicate with Internet thus preventing a potentially compromised host from communicating externally. This can also be used in IN-to-IN policies where appropriate. `ext-resource-session-check` is the FortiGate setting relevant to Traffic Lockdown. It enables FortiGate to check existing active sessions against updates to an External Resource (threat feed) and mark matching sessions as dirty for re-evaluation. This is configured at the system settings level (not per-policy): ``` config system settings set ext-resource-session-check enable end ``` Note: `dyn-addr-session-check` is a separate setting that applies to dynamic address objects (e.g., SDN connectors, FSSO) rather than External Resource threat feeds, and is not the relevant control for Traffic Lockdown. Without ext-resource-session-check enabled, FortiGate only blocks new connection attempts from a newly blocklisted IP — existing established sessions continue unaffected until they naturally terminate. With it enabled, existing sessions are re-evaluated against the updated feed at the smaller of: the feed's configured refresh interval, or 30 minutes. This is not instantaneous — plan EDL refresh intervals accordingly if session cleanup timing matters for your containment requirements. **Timing consideration:** Even with `ext-resource-session-check` enabled, existing session re-evaluation is not instantaneous. FortiGate re-checks dirty sessions at the smaller of the External Resource's configured refresh interval or 30 minutes — whichever comes first. If session cleanup timing is important for your containment requirements, set your EDL/threat feed refresh interval accordingly rather than assuming immediate effect. `dyn-add-session-check` is a FortiGate feature that enables the firewall to check existing sessions against dynamically updated threat feeds (External Connectors/Threat Feeds) and block them when new IPs are added. ### Palo Alto NGFW *Palo Alto employs an External Dynamic List (EDL) to support this capability.* External Dynamic List\ **User Interface:** 1. Log into the Palo Alto firewall web interface 2. Navigate to *Objects → External Dynamic Lists* 3. Click **Add** to create a new list 4. Configure the EDL: * Name: Give it a descriptive name (e.g., **Threat-Feed-BlockList**) * Type: Select **IP List** * Description: Optional but recommended * Source: Enter your URL (`https:///firewall_mgmt/source_ips`) * Check for updates: Choose frequency * **Five Minute** (most frequent) * **Hourly** (recommended for most feeds) * **Daily** * **Weekly** * **Monthly** * Certificate Profile: (Optional) If HTTPS URL requires certificate validation * Exception List: (Optional) IPs to exclude from the block list 5. Click **OK** 6. Commit changes **Command Line:** ``` admin@PA-VM> configure admin@PA-VM# set external-list Vectra_SourceIP_Block_List type ip url "https:///firewall_mgmt/source_ips" admin@PA-VM# set external-list Vectra_SourceIP_Block_List recurring custom-time interval 5 admin@PA-VM# set external-list Vectra_SourceIP_Block_List type ip recurring five-minute admin@PA-VM# commit ``` {% hint style="warning" %} **Important Notes** * The EDL MUST be referenced by a policy or else it won't populate. * If the certificate on Vectra is self-signed then you may need to update the Palo Alto configuration to not require server verification. This can be set using the cli: ``` configure set deviceconfig system server-verification no commit exit ``` {% endhint %} *** ## Troubleshooting ### Firewall Cannot Access Blocklist URL **Symptoms:** Firewall shows connection errors or timeout when attempting to retrieve the blocklist **Resolution:** 1. Verify firewall IP is listed in **Authorized Firewall IPs** (or `0.0.0.0/0` is configured) 2. Confirm network connectivity between firewall and Vectra appliance 3. Check firewall logs for specific error messages 4. Test connectivity: `curl https:///firewall_mgmt/source_ips` from firewall ### Host IP Not Appearing in Blocklist **Symptoms:** Host added to Traffic Lockdown but IP not in feed **Resolution:** 1. It can take up to five minutes for the host IP to appear in the block list 2. Verify host has a valid IP address assigned in Vectra 3. Check that IP is in supported format (single IPv4 address) 4. Allow time for firewall polling cycle (feeds are typically polled every 5-60 minutes) 5. Manually refresh/test the feed URL to confirm IP is present ### Automatic Lockdown Not Triggering **Symptoms:** High-risk hosts not being automatically added to lockdown **Resolution:** 1. Verify **Enable Automatic Traffic Lockdown** toggle is **On** 2. Confirm host urgency score meets or exceeds threshold 3. Confirm host importance level meets or exceeds threshold 4. Remember: **Both** urgency **and** importance thresholds must be exceeded 5. It can take up to five minutes for the host IP to appear in the block list ## Related Features * **Host Lockdown**: EDR-based endpoint isolation * **Account Lockdown**: Identity-based account disablement *** --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.vectra.ai/configuration/response/lockdown/traffic-lockdown.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.