Address Group - Exclusions

This feature introduces the Exclude Members setting in IPv4 address groups. The specified IP addresses or ranges are subtracted from the address group.

This feature is only supported for IPv4 address groups, and only for addresses with a Type of IP Range or Subnet.

To exclude an address or addresses from an address group using the GUI:

1. Go to Policy & Objects > Addresses.
2. Create a new address group, or edit an existing group.

   

3. Enable Exclude Members, and select the addresses that will be excluded from the group.

   

4. Click OK.

   The excluded members are listed in the Exclude Member column.

   

To exclude an address or addresses from an address group using CLI commands:

config firewall addrgrp

edit <address group>

set exclude enable

set exclude-member <address> <address> ... <address>

next

end