>
    Strata Copilot
    Configure Subscriber Objects and Subscriber Group Objects
    Focus
    Download PDF
    Focus
    1. Home
    2. Network Security
    3. Network Security: Security Policy
    4. Policy Objects
    5. Policy Objects: Subscriber and Equipment
    6. Configure Subscriber Objects and Subscriber Group Objects
    Download PDF
    Network Security

    Configure Subscriber Objects and Subscriber Group Objects

    Table of Contents

    Configure Subscriber Objects and Subscriber Group Objects

    Configure subscriber and subscriber group objects for policy rules.
    Where Can I Use This?What Do I Need?
    • NGFW (PAN-OS & Panorama Managed)
    Use subscriber objects to represent mobile network subscribers by name in security policy rules. Subscriber objects can match a single IMSI, a range of IMSI values, or an IMSI prefix. Subscriber group objects collect multiple subscriber objects so that a single policy rule can cover a defined set of subscribers.

    Configure a Subscriber Object (Single IMSI)

    1. Select ObjectsMobile NetworksSubscriber.
    2. Click Add.
    3. Enter a Name for the subscriber object.
    4. (Optional) Enter a Description.
    5. Set Type to IMSI.
    6. Enter the IMSI value (14 or 15 digits).
    7. Click OK.

    Configure a Subscriber Object (IMSI Range)

    An IMSI range matches any IMSI value between a specified start and end. Digits 4 through 15 can differ between the start and end of the range.
    1. Select ObjectsMobile NetworksSubscriber.
    2. Click Add.
    3. Enter a Name for the subscriber object.
    4. (Optional) Enter a Description.
    5. Set Type to IMSI Range.
    6. Enter the Start IMSI value and the End IMSI value.
      Example:
      • Start: 300201400400000
      • End: 300301400400000
    7. Click OK.

    Configure a Subscriber Object (IMSI Prefix)

    An IMSI prefix matches any IMSI that begins with the specified digits. The prefix can start from digit 4 and must end with a * wildcard.
    1. Select ObjectsMobile NetworksSubscriber.
    2. Click Add.
    3. Enter a Name for the subscriber object.
    4. (Optional) Enter a Description.
    5. Set Type to IMSI Prefix.
    6. Enter the prefix value followed by *.
      Example:
      • 300* — matches all IMSIs beginning with 300
      • 300200121* — matches all IMSIs beginning with 300200121
    7. Click OK.

    Configure a Subscriber Group Object

    A subscriber group object references one or more subscriber objects. Use a subscriber group object in a security policy rule when you want a single rule to match a defined set of subscribers.
    1. Select ObjectsMobile NetworksSubscriber Group.
    2. Click Add.
    3. Enter a Name for the subscriber group.
    4. (Optional) Enter a Description.
    5. In the Subscribers field, add the subscriber objects to include in the group.
    6. Click OK.
    7. Commit the configuration.

    Verify Subscriber Configuration

    Use the following CLI commands to verify your subscriber objects and groups:
    show mobile-network subscriber <subscriber-name>
show mobile-network subscriber-group <group-name>

    © 2026 Palo Alto Networks, Inc. All rights reserved.