Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Domain allowlist feed

Some recipients never receive the phishing simulation emails, or the landing page gets blocked, because their firewall inspects or filters the traffic to the campaign domains. Stoïk publishes a domain allowlist feed that your firewall can poll automatically to exempt these domains from SSL inspection and URL filtering.

This guide only covers FortiGate, Palo Alto, and Cato Networks. We haven't found an equivalent setup for other firewall vendors yet.

<allowlist_feed_username> and <allowlist_feed_password> are the credentials provided by Stoïk for your feed. Contact protect@stoik.io if you don't have them.

FortiOS 7.4 / 7.6 / 8.0

Step 1: Create the external resource

In the FortiGate CLI, create a type category external resource pointing at the feed URL. A type domain resource cannot be used for SSL inspection exemption.

config system external-resource
    edit "stoik-allowlist"
        set status enable
        set type category
        set category 192
        set resource "https://prod.phishing.cyber.stoik.io/public/v1/allowlist/domains.txt"
        set username "<allowlist_feed_username>"
        set password "<allowlist_feed_password>"
        set server-identity-check full
        set refresh-rate 5
    next
end

Field notes:

  • set type category is required (not type domain) so the resource can be added to the SSL/SSH inspection exempt list.

  • set category 192 assigns the resource to a custom FortiGuard category slot. Slots 192-221 are available (30 total per scope/VDOM). Choose a free slot; the number must be unique within the scope.

  • set username and set password activate HTTP Basic authentication automatically.

  • set server-identity-check full validates the full TLS certificate chain and hostname. Default is none; full is recommended for HTTPS feeds.

  • set refresh-rate 5 polls every 5 minutes (units are minutes; range 1-43200).

Step 2: Exempt from SSL inspection

Add the category to the SSL/SSH inspection profile's exempt list. This is the mechanism that actually bypasses SSL deep inspection for matching domains. Without this step, FortiGate will still MITM the TLS connection.

GUI path: Security Profiles > SSL/SSH Inspection > your deep-inspection profile > Exempt from SSL Inspection > Web categories > add the stoik-allowlist category.

CLI equivalent:

Step 3: Verify the firewall policy uses the inspection profile

Confirm that the firewall policy covering client outbound traffic references the ssl-ssh-profile you modified in step 2.

Web Filter "Allow" does not pass traffic. Setting the external resource category to Allow in the Web Filter profile does not allow the traffic. Per the FortiOS 7.6 documentation: "Selecting the Allow action for the FortiGuard Category Based Filter does not actually allow the category. It merely implies that no filter has been applied."

If the base FortiGuard rating for a landing domain is Phishing or Malware, the Allow action on the custom category will not override it. Use the SSL/SSH inspection exempt list (step 2) or a Static URL Filter Exempt entry in the web filter profile instead.

Official documentation:

PAN-OS 11.1+

Step 1: Create an External Dynamic List (type URL)

Use type URL, not type Domain. A type Domain EDL is for DNS sinkholing only and cannot be used in URL Filtering profiles or Decryption policy.

GUI path: Objects > External Dynamic Lists > Add

Settings:

  • Type: URL

  • Source: https://prod.phishing.cyber.stoik.io/public/v1/allowlist/domains.txt

  • Client Authentication: enable, then enter the <allowlist_feed_username> and <allowlist_feed_password>

  • Check for updates: Every Five Minutes

Notes:

  • Client Authentication is only available when the source URL is HTTPS.

  • Each unique source URL counts against the 30-source-EDL limit per firewall.

Step 2: Allow traffic in a URL Filtering profile

GUI path: Objects > Security Profiles > URL Filtering > add/edit profile > Categories tab

Find the EDL in the category list and set its action to Allow. Attach this URL Filtering profile to the Security policy rule covering the relevant traffic.

Step 3: Add a No-Decrypt Decryption policy rule

Without this step, the firewall will still decrypt and re-encrypt traffic to the landing domains, which may interfere with TLS certificate validation by the campaign target.

GUI path: Policies > Decryption > Add

Settings:

  • Name: e.g., No-Decrypt-Stoik-Allowlist

  • Source / Destination: Any

  • Service/URL Category tab: add the EDL

  • Options tab > Action: No Decrypt

  • (Optional but recommended) Apply a no-decryption profile that blocks expired or untrusted certificates

Move the rule to the top of the decryption rulebase, above any "Decrypt all HTTPS" or catch-all decrypt rules. Decryption rules are evaluated top-to-bottom; the first match wins.

Commit after saving.

Wildcard coverage: *.example.com matches all subdomains (login.example.com, docs.example.com) but does not match the bare apex example.com. Both lines are present in the feed. PAN-OS URL type silently skips malformed entries; bare domain entries (without a scheme) are treated as example.com/ and match the apex.

Official documentation:

In the Cato Management Application:

  1. Go to Resources > Categories > Containers.

  2. Create a Container with type FQDN.

  3. Select Syncing a file from a URL as the source.

  4. Select the CSV/TXT format and enter the feed URL provided by Stoïk (it already includes your access token).

  5. Select an hourly synchronization interval, then click Test Container before saving.

Official documentation:

PreviousCommon setup errors
NextLaunching a campaign

Last updated

Was this helpful?