Is it possible to write a rule matching any IP ending in .xx

Announcements

Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.

Reply
Saqib
Not applicable

Is it possible to write a rule matching any IP ending in .xx

Hi all,

I have a question, is it possible to write a rule that matches only a part of the IP address? For example match any IP ending in .51? Using wildcards this would be  *.*.*.51


Put another way, i would like to match all IP's that are x.x.x.51 where x is any number. Someone in our teams suggested using 0.0.0.51/32 but this does not work, although there are 0.0.124.0 type rules in our firewall.

Can you clarify if it's possible to match on only a specific part of an IP address and if so how is this done?

Thank you!

Saqib


Accepted Solutions
santonic
L5 Sessionator

Nope, Cisco style wildcard notation is not supported on PA devices yet. I've put in a feature request for this, I'd ask you to do the same please.

View solution in original post


All Replies
HULK
L7 Applicator

Hello Saqib,

I hope 0.0.0.51/32 will not work, since this indicates a specific host /32 ip address ( only 0.0.0.51 ip address). Regex will also not work, because it requires at least 7 byte fixed data patterns.

In Regex, every pattern you create must contain at least a 7-byte string with fixed values.

o The 7-byte fixed string can be anywhere in your pattern.

o The 7 values must be fixed, this means no ‘.’ (dot), no ‘*’ (star), no ‘+’ (plus), or other wildcard characters within the 7 bytes. Hence, it will not be applicable for the mentioned IP address 0.0.0.51/32.

Hope this helps.

Thanks

santonic
L5 Sessionator

Nope, Cisco style wildcard notation is not supported on PA devices yet. I've put in a feature request for this, I'd ask you to do the same please.

View solution in original post

HULK
L7 Applicator

Here is the details of the feature request: For questions like these you may talk to your SE to place feature requests.

Subject: Subnet wildcards in a security policy

FR ID: 1038

Hope this helps.

Thanks

panos
L6 Presenter

can someone share FR ID please.

Saqib
Not applicable

Thanks guys, this has been very helpful, I will contact out SE. (Sales Executive?) and ask for this feature.

santonic
L5 Sessionator

Is there a place where you can see all the feature requests?

hshah
L6 Presenter

Hi Santonic,

Customer dont have access to it, you can get that information either from forum or from TAC or from SE.

Regards,

Hardik Shah

Usama-Ahmed
L0 Member

Wildcard IP objects are supported as of PAN-OS 9.0. Please see the documentation below on it. 

 

Also, please do watch out for the longest prefix match limitation/caveat.

 

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/networking-features/wildcard-addres...

 

You could do a match of x.x.x.51 Ip addresses via wildcard IP object of 10.0.0.51/255.255.255.0. 

Please do double-check my math. 

 

Also to my knowledge, you cannot add IP Wildcard addresses to address groups. 

 

Thanks

Usama Ahmed

 

Tags (1)
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!