Forum Discussion

p_wegnerowski's avatar
p_wegnerowski
Comet
2 months ago

LAN Firewall rules - missing "IP range" in src/dst

Anyone else missing an ability to use Custom IP Range as a source or destination in LAN Firewall rule? We use CATO LAN Firewall to control traffic between two separate network zones terminated on two different internal firewalls. Since this is a local traffic in the site, we don't want to route it to Cato Cloud so it's not dependent on WAN links. That's why we use CATO LAN Firewall (formerly Local Routing). But the only options to set Source or Destination are: Global range, Host, Interface subnet, Network Interface and Any. Would be very useful if we can use Custom IP ranges and Host Groups there.

security
  • michaelsaw's avatar
    michaelsaw
    Icon for Cato Employee rankCato Employee
    2 months ago

    Hi p_wegnerowski, 

    You mean to have the ability to configure a group/list of custom IP Addresses like "192.168.1.99", "10.10.1.10-10.10.1.20" (that is not part of any hosts) in CMA, right? 
    This looks like a potential RFE. Have you discussed it with any Cato Representative, so far?

    Thank you.

    • p_wegnerowski's avatar
      p_wegnerowski
      Comet
      2 months ago

      Hi michaelsaw my biggest wish is to use custom IP/ranges in LAN Firewall rules. 

      If not possible, then the ability to configure a group of Hosts would be a workaround for this limitation - we usually register Hosts for the devices controlled by LAN Firewall.

      The ability to configure a group of custom IP addresses/ranges (that you described) would be a great enhancement to both options.

      I haven't discussed it with anyone from Cato yet. I was wondering if other users face the same problem and how they deal with it, before raising RFE.

      • Nath's avatar
        Nath
        Meteor
        2 months ago

        This may need clarification from Cato representatives, but from recent meetings we've had I believe there is a plan to move the LAN FW into the general WAN FW rulebase.  Not sure if that will solve your issue and allow the use of more advanced source criteria in a FW rule.