Forum Discussion

Renato_166638's avatar
Renato_166638
Icon for Nimbostratus rankNimbostratus
Sep 21, 2017
Solved

Invert match in AFM policy

Hi!   Is it possible to invert the match sense in AFM parameters like we do using ! with iptables?   Thanks!  
AFM
security
  • Richard_Karon_7's avatar
    Richard_Karon_7
    Jul 01, 2018

    if you would like to change a single allowed address such as this one

     

    1. accept all traffic to 10.1.1.1/32

    you can invert this to disallow the traffic by using specific rules first and allow more general rules after.

     

    for example assuming the rest of the network is a 24 bit subnet mask,

     

    1. drop/reject all traffic for 10.1.1.1/32
    2. accept all traffic to 10.1.1.0/24

    or vice-versa if you want to allow your specific ip address on a blocked subnet.

     

Richard_Karon's avatar
Richard_Karon
Icon for Employee rankEmployee

if you would like to change a single allowed address such as this one

 

  1. accept all traffic to 10.1.1.1/32

you can invert this to disallow the traffic by using specific rules first and allow more general rules after.

 

for example assuming the rest of the network is a 24 bit subnet mask,

 

  1. drop/reject all traffic for 10.1.1.1/32
  2. accept all traffic to 10.1.1.0/24

or vice-versa if you want to allow your specific ip address on a blocked subnet.

 

Renato_166638's avatar
Renato_166638
Icon for Nimbostratus rankNimbostratus
Jul 18, 2018

Richard, that was a long time ago, but you suggestion is probably what I did. I was migrating some policies from PaloAlto to AFM and also trying to make it the more similar I could at same time for the customer.