Adds a rule to a network policy that bypasses traffic either to or from a specified IPv4 or IPv6 address and mask.
When you configure rules for a network policy on the Network Security appliance, you can control which traffic to whitelist based on the destination IP address, source IP address, or mask. You can configure rules for a specified network port pair or all network port pairs. You can configure multiple network policy rules with different subnets for your organization.
Important
You must enter each rule separately. You can add up to 512 rules to the network policy. The network policy rules are optional.
For details about how to add a rule to a network policy, see the "Configuring SSL Interception" chapter of the Network Security User Guide.
Syntax
policymgr ssl-intercept network ip <IP_address>|<prefix>|<any> interface <port-pair-name> pass-through
Parameters
<IP_address|<prefix>|<any>
IP source or destination address for the network policy rule. To match any IP address for the network port pair, enter any.
<port-pair-name>
Network port pair designation (A through F) that is configured on the appliance interface. To specify all the network port pairs, enter ALL.
pass-through
Bypass traffic matching the rule.
Example
The following example adds a rule to a network policy that bypasses traffic matching the specified IPv4 address and mask.
hostname (config) # policymgr ssl-intercept network ip 12.23.22.0/24 interface A pass-through
The following example adds a rule to a network policy that decrypts traffic matching the specified based on the IPv6 address and mask:
hostname (config) # policymgr ssl-intercept network ip 2002:470:84a7:1720:ae1f:6bff:fe12:3e03/128 interface A pass-through
User role
Admin or Operator
Command mode
Config
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Network Security: Release 8.2.1. Support to add up to 512 rules to the network policy was added in Release 8.3.2.