Security Policy Exception

[Gun-Slinger]

Has Palo Alto looked into the capability for security policies to be built using an exception based logic. For example:

Src: 10.0.0.0/8 (except) 10.100.0.0/24 Dst: ** App: ** etc.... This would then allow all 10. traffic except for the 10.100.0.0/24 subnet

This is a function available in Checkpoint and some other platforms that has been very helpful, especially in preventing our policies from being filled with random drop rules.

Thank you

[jsalmans]

I can't speak to what Palo Alto has considered, of course, but is this mostly just a convenience thing to prevent the creation of two firewalls rules?

i.e.

1. Deny 10.100.0.0/24
2. Allow 10.0.0.0/8

I'm sitting her smiling imagining having all of that in one rule and someone else looking at the logs and, based on how I've been naming things, scratching their head wondering why an IP in 10.100.0.0/24 is being denied by "Allow Internal Ranges to X Server".

[bradk14 · Accepted solution]

if your source zone consists of only 10.0.0.0/8, what you could do is put a source IP of 10.100.0.0/24 and check the negate option. that way the policy will only apply to IPs sourced from that zone that are NOT in the 10.100.0.0/24 range.