Next-Generation Firewall
Configure a Filter Prefix List
Table of Contents
Configure a Filter Prefix List
Configure a filter prefix list to filter network routes that are added to a local
RIB.
Contact your account team to enable Cloud Management for NGFWs using
Strata Cloud Manager.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
One of these:
|
Configure a filter prefix list to filter network routes that are added to the local
RIB based on route prefix and prefix length. A prefix list can have multiple rules.
Routes are evaluated against other rules in sequential order. When a route matches a
rule, the deny or permit action occurs and the route isn’t evaluated against
subsequent rules.
A prefix list is flexible in that it allows you to configure a prefix with a prefix
length that together identifies the prefix, and also have a range by specifying
that the prefix length be greater than, less than, or equal to a value. The firewall
evaluates prefix lists more efficiently than access lists.
- Log in to Strata Cloud Manager.Select and select the Configuration Scope where you want to configure a prefix list.You can select a folder or firewall from your Folders or select Snippets to configure a prefix list in a snippet.Add Filters Prefix List.Enter a Name for the prefix list.The name must start with an alphanumeric character, underscore (_), or hyphen (-), and can contain a combination of alphanumeric characters, underscore, or hyphen. No dot (.) or space is supported.Configure the prefix list rule.
- Enter the Seq number of the prefix list filtering rules in the list of rules for the prefix list.Range is 1 to 65,535.Leave unused numbers between sequence numbers so you can insert additional rules faster.Select the Action.Default is Deny.Specify the Source Address.You can select None (default), Any, or Network.(Address only) If you select Address, enter the IPv4 Address and Wildcard mask to indicate a range. A zero (0) in the mask indicates that a bit must match the corresponding bit in the address; a one (1) in the mask indicates a "don't care" bit.(Network only) Enter the IPv4 Network with a slash and prefix length.(Optional) Enter the prefix length that the prefix must be Greater Than or Equal to (range is 0 to 32.(Optional) Enter the prefix length that the prefix must be Less Than or Equal to (range is 0 to 32.Add.Save.
