topic Re: Palo Alto Negate Object Meaning in Advanced Threat Prevention Discussions

Palo Alto Negate Object Meaning

Steven-Chua — Tue, 10 Apr 2018 19:04:33 GMT

Hi,

I have a question on Palo Alto negate object. If I have a allow rule that allow src zone A, src IP of 10.10.10.0/24 (Negate) to dst zone B, dest IP of ANY.

Does it mean that the rule is allowing other src IP (not including 10.10.10.0/24) from src zone A to dst zone B, dest IP of ANY?

Please advice.

Thks and Rgds

Re: Palo Alto Negate Object Meaning

mivaldi — Tue, 10 Apr 2018 21:27:56 GMT

That is correct.

'Negate' converts the selection scope from:

" include the listed subnets or addresses from 'any' "

to:

" exclude the listed subnets or addresses from 'any' "

(Negate is "Complement").

Re: Palo Alto Negate Object Meaning

Steven-Chua — Thu, 12 Apr 2018 23:46:18 GMT

Hi Mivaldi,

Many thanks for the reply.

Thks and Rgds