Best practice for allow Internet IP

[thanawat_l]

Dear All,

Now I want to optimize security policy, I have many rule that allow any but now I want to change from "any" to "Internet IP". Does PaloAlto have internet ip object by default? or how I define internet ip in address?

Thank you for your help.

[PavelK · Accepted solution]

Hello @thanawat_l

I think you can do it in reverse way by using "negate" in policy to allow anything except of reserved RFC1918 addresses that are not routable on internet.

For these ranges there are Palo Alto built-in objects including class D IP ranges that you can exclude from policy and allow anything also on internet.

Kind Regards

Pavel

[thanawat_l]

Hi @PavelK ,

Thank you for your answer.