Is it possible to write a rule matching any IP ending in .xx

[Saqib]

Hi all,

I have a question, is it possible to write a rule that matches only a part of the IP address? For example match any IP ending in .51? Using wildcards this would be  *.*.*.51

Put another way, i would like to match all IP's that are x.x.x.51 where x is any number. Someone in our teams suggested using 0.0.0.51/32 but this does not work, although there are 0.0.124.0 type rules in our firewall.

Can you clarify if it's possible to match on only a specific part of an IP address and if so how is this done?

Thank you!

Saqib

[HULK]

Hello Saqib,

I hope 0.0.0.51/32 will not work, since this indicates a specific host /32 ip address ( only 0.0.0.51 ip address). Regex will also not work, because it requires at least 7 byte fixed data patterns.

In Regex, every pattern you create must contain at least a 7-byte string with fixed values.

o The 7-byte fixed string can be anywhere in your pattern.

o The 7 values must be fixed, this means no ‘.’ (dot), no ‘*’ (star), no ‘+’ (plus), or other wildcard characters within the 7 bytes. Hence, it will not be applicable for the mentioned IP address 0.0.0.51/32.

Hope this helps.

Thanks

[santonic · Accepted solution]

Nope, Cisco style wildcard notation is not supported on PA devices yet. I've put in a feature request for this, I'd ask you to do the same please.

[HULK]

Here is the details of the feature request: For questions like these you may talk to your SE to place feature requests.

Subject: Subnet wildcards in a security policy

FR ID: 1038

Hope this helps.

Thanks

[panos]

can someone share FR ID please.

[Saqib]

Thanks guys, this has been very helpful, I will contact out SE. (Sales Executive?) and ask for this feature.

[santonic]

Is there a place where you can see all the feature requests?

[hshah]

Hi Santonic,

Customer dont have access to it, you can get that information either from forum or from TAC or from SE.

Regards,

Hardik Shah

[Usama-Ahmed]

Wildcard IP objects are supported as of PAN-OS 9.0. Please see the documentation below on it. 

Also, please do watch out for the longest prefix match limitation/caveat.

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/networking-features/wildcard-addres...

You could do a match of x.x.x.51 Ip addresses via wildcard IP object of 10.0.0.51/255.255.255.0. 

Please do double-check my math. 

Also to my knowledge, you cannot add IP Wildcard addresses to address groups. 

Thanks

Usama Ahmed