08-23-2025 12:25 PM
Hi this maybe a simple or dumb question, but I have a rule shown below that has specific sources defined. I thought the rule would only match on those host listed in the source, but when looking at the logs, I can see other source IP's are matching on this rule. Can anyone explain why the other source IP's that are not listed in this rule match this rule?
this is the rule
When looking at the logs I am seeing IP's other than the listed source match on this rule.
08-24-2025 05:56 PM
Hi @E.Hinkle ,
If you click into the Security Policy and review the Source tab, can you confirm whether the entries are address objects or IP entries? It looks like at least one of them (ip-10.35.5.71) may be an object.
Please check the object definition and see if the object was created with a CIDR/netmask instead of it being a single host/32 which would explain why you're seeing other 10.35.5.x IPs in the traffic log.
Id also review the modified tab to see when it was last modified.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
