topic 40031 Threat Exception in General Topics

40031 Threat Exception

FarzanaMustafa — Thu, 13 Aug 2020 05:50:49 GMT

What I am wanting to know is if I can add a range of IP addresses to a vulnerability exception.

This would be the entire 1-254 range, rather than 1 IP address at a time.

I have already checked the links below and they talk about adding IP addresses one at a time as an exemption.

Rather than allowing the vulnerability for the entire site, I would like to allow it for 192.168.1.0/24 for example.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm60CAC

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClhcCAC

Re: 40031 Threat Exception

RamprakashRT — Thu, 13 Aug 2020 14:31:50 GMT

Hi @FarzanaMustafa

Currently exemption is allowed only for single ip address not a subnet. Suggesting a workaround,

1)Clone the vulnerability profile and create the exemption ( without ipaddress)

2)create a new security policy with desired range, subnet as source and assign the new vulnerability profile ( cloned one).

Hope it helps.

Thanks,

Ram

Re: 40031 Threat Exception

BPry — Sat, 15 Aug 2020 03:38:26 GMT

@FarzanaMustafa,

The profile duplication and a new security rulebase entry is the best option as @RamprakashRT already mentioned if you are creating an exception for an entire subnet. I would really look at if you actually require an exception for an entire subnet though. Are you running into a false positive detection?