Has Palo Alto looked into the capability for security policies to be built using an exception based logic. For example:
Src: 10.0.0.0/8 (except) 10.100.0.0/24 Dst: ** App: ** etc.... This would then allow all 10. traffic except for the 10.100.0.0/24 subnet
This is a function available in Checkpoint and some other platforms that has been very helpful, especially in preventing our policies from being filled with random drop rules.
Solved! Go to Solution.
I can't speak to what Palo Alto has considered, of course, but is this mostly just a convenience thing to prevent the creation of two firewalls rules?
I'm sitting her smiling imagining having all of that in one rule and someone else looking at the logs and, based on how I've been naming things, scratching their head wondering why an IP in 10.100.0.0/24 is being denied by "Allow Internal Ranges to X Server".
if your source zone consists of only 10.0.0.0/8, what you could do is put a source IP of 10.100.0.0/24 and check the negate option. that way the policy will only apply to IPs sourced from that zone that are NOT in the 10.100.0.0/24 range.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The Live Community thanks you for your participation!