topic Object Group with exclusions in General Topics

Object Group with exclusions

Vikram511 — Wed, 17 Jun 2020 10:33:59 GMT

Checkpoint has option to creat an address group object with exclusion (e.g Include 10.20.x.x/16 and exclude 10.20.30.0/24 or other subnets from supernet). Is similar option available in Palo Alto.

Negate option in PA is just to negate all source/destination.

Re: Object Group with exclusions

BPry — Wed, 17 Jun 2020 21:18:44 GMT

@Vikram511,

You can't exclude in an address or address-group object. If you want this feature you would need to reach out to your SE and get a feature request put together or have your vote added to an existing request.

You are correct that negate-source and negate-destination will negate anything specified and match everything else.

Re: Object Group with exclusions

Vikram511 — Thu, 18 Jun 2020 04:00:21 GMT

@BPry Thanks for the quick reply.

I checked in expedition while converting the object group with exclusion it has converted the object group into range of address excluding the subnet which was under exclude list in the checkpoint object. It serves the purpose.