Adds the policy configuration rule for the source IP address to a network allowed list. You enter each rule separately. You can add up to 256 network allowed list rules.
Important
After you add a rule to a network allowed list, use the
policymgr refresh-policycommand in the CLI configuration mode to refresh the policy configuration.
Syntax
policymgr network src <IPAddress> <maskLength> interface <interfaceType> [vlan <vlanID>] allow
no policymgr network src <IPAddress> <maskLength> [vlan <vlanID>]
Parameters
no
Use the no form of this command to delete the policy configuration for the source IP address from the network allowed list.
<IPAddress>
Source IP address that matches the defined IP address or mask.
<maskLength>
Valid Classless Inter-Domain Routing (CIDR) mask for the host prefix.
allow
Configures the policy action to allow traffic from the specified host, network, or VLAN.
interface
Adds the interface to the network allowed list.
<interfaceName>
Name of the interface to apply the network allowed list. When you apply interface A, traffic entering the Network Security appliance on pether3 and pether4 is allow listed. When you apply interface B, traffic entering the Network Security appliance on pether5 and pether6 is allow listed. The following interfaces are available:
For the Trellix NX 10000 models: ALL or A.
For all other Trellix models: ALL, A, B, B1, or B2.
<vlanID>
VLAN identification number to add to the network allowed list. The default value is "ALL". The range is from 1 to 4094.
Example
The following example shows how to add the policy configuration for the source IP address and mask length to a network allowed list.
hostname (config) # policymgr network src 23.1.1.1/32 interface ALL allow
hostname(config)# policymgr refresh-policy
The following example shows how to remove the policy configuration for the source IP address and mask length from a network allowed list.
hostname (config) # no policymgr network src 23.1.1.1/32
hostname(config)# policymgr refresh-policy
User role
Admin or Operator
Command mode
Config
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Network Security: Before Release 7.5. A total of 256 rule entries can be configured on a network allowd list in Release 8.0.