Policy Objects: Subscriber and Equipment
Learn about subscriber and equipment objects available for mobile 5G
networks.
| Where Can I Use This? | What Do I Need? |
|---|
- NGFW (PAN-OS & Panorama Managed)
|
|
In enterprise mobile networks, IMSI (International Mobile Subscriber Identity)
and IMEI (International Mobile Equipment Identity) serve as the primary identifiers for
subscribers and devices. Unlike IP addresses — which can be organized into named address
objects and groups for use in security policy rules — IMSI and IMEI values are long
numeric strings that carry no inherent meaning to firewall administrators.
Before PAN-OS 12.2, referencing a subscriber or device in a security policy
rule required entering raw IMSI or IMEI values directly into the rule. Each reference
required looking up the value, updating every rule where that subscriber or device
appeared, and accepting that the rule would be opaque to anyone reading it later.
PAN-OS 12.2 introduces four new object types that bring the same organization
and readability to mobile network identifiers that address objects bring to IP
addresses:
Subscriber objects represent individual subscribers by IMSI
value, range, or prefix.
Subscriber Group objects collect multiple subscriber objects
into a single referenceable group.
Equipment objects represent individual devices by IMEI value,
range, or prefix.
Equipment Group objects collect multiple equipment objects into
a single referenceable group.
Once defined, these objects can be used as the source subscriber and source
equipment criteria in security policy rules, the same way address objects are used as
source and destination criteria in standard policy rules.
Object Types
Subscriber objects support three identifier types:
| Type | Format | Description |
|---|
| IMSI | 14–15 digits | Matches a single subscriber by exact IMSI
value. |
| IMSI Range | Two IMSI values (start and end) | Matches any IMSI within the specified range. Digits
4–15 can vary between the start and end of the range. |
| IMSI Prefix | Partial IMSI followed by * | Matches any IMSI beginning with the specified prefix.
The prefix can start from digit 4 (for example, 300* or
300200121*). |
Equipment objects support three identifier types:
| Type | Format | Description |
|---|
| IMEI | 15–16 digits | Matches a single device by exact IMEI value. |
| IMEI Range | Two IMEI values (start and end) | Matches any IMEI within the specified range. Digits
7–16 can vary between the start and end of the range. |
| IMEI Prefix | Partial IMEI followed by * | Matches any IMEI beginning with the specified prefix.
The prefix can start from digit 6 (for example, 353234121* or
35323412122*). |
Note: MSISDN-based subscriber types are not available in the PAN-OS
12.2.2 release.
Groups
Subscriber Group and Equipment Group objects each hold a list of their
respective object type. When a group is referenced in a policy rule, the rule
matches any subscriber or device that belongs to any object in the group. Groups
make it practical to apply a single rule to a fleet of devices or a defined set of
subscribers without listing each identifier individually.
Each platform has a maximum number of subscriber and equipment objects,
groups, and members per group. See
Subscriber and Equipment Object Capacity
Limits for platform-specific values. When the limit is reached, the
firewall displays a warning at configuration time.
Use in Security Policy
Subscriber and Equipment objects are referenced in security policy rules
through the Source Subscriber and Source Equipment fields. A rule can
reference individual objects or groups. The firewall flattens group membership at
policy evaluation time, so a rule referencing a group behaves identically to one
that lists each member individually.
