topic Re: Is it possible to write a rule matching any IP ending in .xx in General Topics

Is it possible to write a rule matching any IP ending in .xx

Saqib — Wed, 22 Oct 2014 07:27:20 GMT

Hi all,

I have a question, is it possible to write a rule that matches only a part of the IP address? For example match any IP ending in .51? Using wildcards this would be *.*.*.51

Put another way, i would like to match all IP's that are x.x.x.51 where x is any number. Someone in our teams suggested using 0.0.0.51/32 but this does not work, although there are 0.0.124.0 type rules in our firewall.

Can you clarify if it's possible to match on only a specific part of an IP address and if so how is this done?

Thank you!

Saqib

Re: Is it possible to write a rule matching any IP ending in .xx

HULK — Wed, 22 Oct 2014 08:13:53 GMT

Hello Saqib,

I hope 0.0.0.51/32 will not work, since this indicates a specific host /32 ip address ( only 0.0.0.51 ip address). Regex will also not work, because it requires at least 7 byte fixed data patterns.

In Regex, every pattern you create must contain at least a 7-byte string with fixed values.

o The 7-byte fixed string can be anywhere in your pattern.

o The 7 values must be fixed, this means no ‘.’ (dot), no ‘*’ (star), no ‘+’ (plus), or other wildcard characters within the 7 bytes. Hence, it will not be applicable for the mentioned IP address 0.0.0.51/32.

Hope this helps.

Thanks

Re: Is it possible to write a rule matching any IP ending in .xx

santonic — Wed, 22 Oct 2014 09:02:26 GMT

Nope, Cisco style wildcard notation is not supported on PA devices yet. I've put in a feature request for this, I'd ask you to do the same please.

Re: Is it possible to write a rule matching any IP ending in .xx

HULK — Wed, 22 Oct 2014 09:10:49 GMT

Here is the details of the feature request: For questions like these you may talk to your SE to place feature requests.

Subject: Subnet wildcards in a security policy

FR ID: 1038

Hope this helps.

Thanks

Re: Is it possible to write a rule matching any IP ending in .xx

Retired Member — Wed, 22 Oct 2014 09:18:41 GMT

can someone share FR ID please.

Re: Is it possible to write a rule matching any IP ending in .xx

Saqib — Wed, 22 Oct 2014 09:20:08 GMT

Thanks guys, this has been very helpful, I will contact out SE. (Sales Executive?) and ask for this feature.

Re: Is it possible to write a rule matching any IP ending in .xx

santonic — Wed, 22 Oct 2014 10:27:40 GMT

Is there a place where you can see all the feature requests?

Re: Is it possible to write a rule matching any IP ending in .xx

hshah — Wed, 22 Oct 2014 14:51:03 GMT

Hi Santonic,

Customer dont have access to it, you can get that information either from forum or from TAC or from SE.

Regards,

Hardik Shah

Re: Is it possible to write a rule matching any IP ending in .xx

Usama-Ahmed — Fri, 26 Feb 2021 19:21:09 GMT

Wildcard IP objects are supported as of PAN-OS 9.0. Please see the documentation below on it.

Also, please do watch out for the longest prefix match limitation/caveat.

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/networking-features/wildcard-address

You could do a match of x.x.x.51 Ip addresses via wildcard IP object of 10.0.0.51/255.255.255.0.

Please do double-check my math.

Also to my knowledge, you cannot add IP Wildcard addresses to address groups.

Thanks

Usama Ahmed