negate destination IP's

[jdprovine]

@reaper @BPry

Is you create an allow rule and then select to negate the destination IP's does that mean those IP's are blocked?

[santonic]

Nope, it means all IPs except those will match that field in rule.

[jdprovine]

@santonic

Thats what I thought, they can be picked up by another rule and still be allowed

[reaper]

correct, it simply means "match everything except these"

[jdprovine]

@reaper @santonic

Just for curiousity what would be a good use case of using negate instead of just not adding those IP ranges to the rule

[BPry]

@jdprovine,

When there are specific IPs within a given range that you would want to exclude. For example; If I created a policy that says that everything within my 'GUEST' zone is denied from accessing anything within my 'SERVER' zone I would likely want to negate my switches so they could actually access NTP servers and DHCP services. 

[jdprovine]

@BPry

Then those IP's that you negate from that rule can still match on another rule and be allowed. I can see where it might save you time if you have alot of IP's to block and only a few that you don't want blocked on that rule