Is it possible to write a rule matching any IP ending in .xx

[Saqib]

Hi all,

I have a question, is it possible to write a rule that matches only a part of the IP address? For example match any IP ending in .51? Using wildcards this would be  *.*.*.51

Put another way, i would like to match all IP's that are x.x.x.51 where x is any number. Someone in our teams suggested using 0.0.0.51/32 but this does not work, although there are 0.0.124.0 type rules in our firewall.

Can you clarify if it's possible to match on only a specific part of an IP address and if so how is this done?

Thank you!

Saqib

[Saqib]

Thanks guys, this has been very helpful, I will contact out SE. (Sales Executive?) and ask for this feature.

[santonic]

Is there a place where you can see all the feature requests?

[hshah]

Hi Santonic,

Customer dont have access to it, you can get that information either from forum or from TAC or from SE.

Regards,

Hardik Shah

[Usama-Ahmed]

Wildcard IP objects are supported as of PAN-OS 9.0. Please see the documentation below on it. 

Also, please do watch out for the longest prefix match limitation/caveat.

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/networking-features/wildcard-addres...

You could do a match of x.x.x.51 Ip addresses via wildcard IP object of 10.0.0.51/255.255.255.0. 

Please do double-check my math. 

Also to my knowledge, you cannot add IP Wildcard addresses to address groups. 

Thanks

Usama Ahmed