Adds a policy configuration rule for a destination IP address to a network allowlist. You enter each rule separately. You can add up to 256 network allowlist rules.
Important
After you enter this command, you must use the policymgr refresh-policy to apply your changes.
Syntax
policymgr network dst <IPAddress> <maskLength> interface <interfaceType> [vlan <vlanID>]allow
[no] policymgr network dst <IPAddress> <maskLength> [vlan <vlanID>]
Parameters
no
Use the no form of this command to delete the policy configuration for the destination IP address from the network allowlist.
<IPAddress>
Destination IP address that matches the defined IP address or mask.
<maskLength>
Valid network mask for the host prefix.
allow
Allows traffic from the specified host, network, or VLAN.
interface
Adds the interface to the network allowlist.
<interfaceName>
The interface on which to apply the network allowlist. When you specify interface A, traffic entering the Network Security appliance on pether3 and pether4 is allowlisted. When you specify interface B, traffic entering the Network Security appliance on pether5 and pether6 is allowlisted. The following interfaces are available:
For the Trellix NX 10000 models: ALL or A.
For all other Trellix models: ALL, A, B, B1, or B2.
vlan
Adds the VLAN to the network allowlist.
<vlanID>
VLAN identification number to add to the network allowlist. The default value is "ALL". The range is from 1 to 4094.
Example
The following example shows how to add the policy configuration for the destination IP address and mask length to a network allowlist.
hostname (config) # policymgr network dst 23.1.1.2/32 interface ALL allow
hostname (config) # policyorg refresh-policy
The following example shows how to remove the policy configuration for the destination IP address and mask length from a network allowlist.
hostname (config) # no policymgr network dst 23.1.1.2/32
hostname (config) # policymgr refresh-policy
User role
Admin or Operator
Command mode
Config
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Network Security: Before Release 7.5. A total of 256 rule entries can be configured on a network allowlist in Release 8.0.