topic Re: negate destination IP's in General Topics

negate destination IP's

jdprovine — Mon, 08 Oct 2018 12:27:06 GMT

@reaper @BPry

Is you create an allow rule and then select to negate the destination IP's does that mean those IP's are blocked?

Re: negate destination IP's

santonic — Mon, 08 Oct 2018 13:03:00 GMT

Nope, it means all IPs except those will match that field in rule.

Re: negate destination IP's

jdprovine — Mon, 08 Oct 2018 13:05:45 GMT

@santonic

Thats what I thought, they can be picked up by another rule and still be allowed

Re: negate destination IP's

reaper — Thu, 11 Oct 2018 13:51:42 GMT

correct, it simply means "match everything except these"

Re: negate destination IP's

jdprovine — Thu, 11 Oct 2018 14:39:01 GMT

@reaper @santonic

Just for curiousity what would be a good use case of using negate instead of just not adding those IP ranges to the rule

Re: negate destination IP's

BPry — Thu, 11 Oct 2018 15:41:11 GMT

@jdprovine,

When there are specific IPs within a given range that you would want to exclude. For example; If I created a policy that says that everything within my 'GUEST' zone is denied from accessing anything within my 'SERVER' zone I would likely want to negate my switches so they could actually access NTP servers and DHCP services.

Re: negate destination IP's

jdprovine — Thu, 11 Oct 2018 16:08:55 GMT

@BPry

Then those IP's that you negate from that rule can still match on another rule and be allowed. I can see where it might save you time if you have alot of IP's to block and only a few that you don't want blocked on that rule