topic Re: Best practice for allow Internet IP in General Topics

Best practice for allow Internet IP

thanawat_l — Tue, 28 Jun 2022 03:52:46 GMT

Dear All,

Now I want to optimize security policy, I have many rule that allow any but now I want to change from "any" to "Internet IP". Does PaloAlto have internet ip object by default? or how I define internet ip in address?

Thank you for your help.

Re: Best practice for allow Internet IP

PavelK — Tue, 28 Jun 2022 05:12:38 GMT

Hello @thanawat_l

I think you can do it in reverse way by using "negate" in policy to allow anything except of reserved RFC1918 addresses that are not routable on internet.

For these ranges there are Palo Alto built-in objects including class D IP ranges that you can exclude from policy and allow anything also on internet.

Kind Regards

Pavel

Re: Best practice for allow Internet IP

thanawat_l — Tue, 28 Jun 2022 16:01:01 GMT

Hi @PavelK ,

Thank you for your answer.