This Nominated Discussion Article is based on the post "Security Profile Question". Read on to see the discussion and solution!

   

This article is based on a discussion, Best practice to allow Internet IPs, posted by @thanawat_l and answered by @PavelK . Read on to see the discussion and solution!    I want to optimize my security policy. I have many rules that allow any, but I want to change from any to internet IP. Does PaloAlto have an Internet IP object by default? or how can I define internet IP space in address?   Solution: You can do it reverse by using "negate" in policy to allow anything except reserved RFC1918 addresses that are not routable on the internet.    For these ranges there are Palo Alto built-in objects including class D IP ranges that you can exclude from policy and allow anything also on internet.    

This article is based on a discussion, Can we input address range directly to security policy source and destination, posted by @thanawat_l and answered by @aleksandar.astardzhiev. Read on to see the discussion and solution!     Can you input an address range directly to security policy source and destination? Or we need to create a network range object to apply in address only?       You can add this directly in a policy.   You can put host IP, IP/prefix, range and wildcard address in a policy without creating them as an object first.