While whitelist is NOT directly available as part of the network feed itself, you can correctly implement this with layers to accomplish what you want.
Create a new layer that is executed before your normal policy. The default for this layer should be to allow all traffic and don’t log it.
Create a whitelist rule to explicity allow the traffic in desired directions, log or don’t to show it was allowed.
Create a network feed rules after this rule to block traffic in desired directions, log or don’t to show it was blocked.
This layer is executed first and “falls thru” to the network policy for additional inforcement.
This layered method does process the accepted packets twice, but presumably you are attempting to block lots of bad actors/ip addresses and really don’t need to process them thru the whole security policy.
Personally we turn off logging on these after testing them to make sure that they are not blocking unexpected networks like VPN or private internal addresses. If they do, we can put them into the whitelist.
Ted Serreyn
