topic wrong traffic matching rule in General Topics

wrong traffic matching rule

E.Hinkle — Sat, 23 Aug 2025 19:25:23 GMT

Hi this maybe a simple or dumb question, but I have a rule shown below that has specific sources defined. I thought the rule would only match on those host listed in the source, but when looking at the logs, I can see other source IP's are matching on this rule. Can anyone explain why the other source IP's that are not listed in this rule match this rule?

this is the rule

When looking at the logs I am seeing IP's other than the listed source match on this rule.

Re: wrong traffic matching rule

JayGolf — Mon, 25 Aug 2025 00:56:18 GMT

Hi @E.Hinkle ,

If you click into the Security Policy and review the Source tab, can you confirm whether the entries are address objects or IP entries? It looks like at least one of them (ip-10.35.5.71) may be an object.

Please check the object definition and see if the object was created with a CIDR/netmask instead of it being a single host/32 which would explain why you're seeing other 10.35.5.x IPs in the traffic log.

Id also review the modified tab to see when it was last modified.