40031 Threat Exception

[FarzanaMustafa]

What I am wanting to know is if I can add a range of IP addresses to a vulnerability exception.

This would be the entire 1-254 range, rather than 1 IP address at a time.

I have already checked the links below and they talk about adding IP addresses one at a time as an exemption.

Rather than allowing the vulnerability for the entire site, I would like to allow it for 192.168.1.0/24 for example.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm60CAC

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClhcCAC

[RamprakashRT · Accepted solution]

Hi @FarzanaMustafa 

Currently exemption is allowed only for single ip address not a subnet. Suggesting a workaround,

1)Clone the vulnerability profile and create the exemption ( without ipaddress) 

2)create a new security policy with desired range, subnet as source and assign the new vulnerability profile ( cloned one).

Hope it helps.

Thanks,

Ram

[BPry]

@FarzanaMustafa,

The profile duplication and a new security rulebase entry is the best option as @RamprakashRT already mentioned if you are creating an exception for an entire subnet. I would really look at if you actually require an exception for an entire subnet though. Are you running into a false positive detection?