Event Variable - Internet Address Range

[mvpwendel01]

I am looking to create an event variable for any external IP addresses. My current event variable value for $OUT is: 0.0.0.0 - 255.255.255.255. Is there way to make it so that this event variable excludes my $INTERNAL and $DMZ address ranges? It seems like there is overlapping ranges otherwise. Thanks.

[mhellman]

On version 5.x via the IDM...the $ANY variable is 0.0.0.0-255.255.255.255.

I've never really found good documentation that describes the process. However, if you define more specific event variables they will match. So if you define your $INTERNAL and $DMZ address ranges, it should work as expected. i.e. if you use $ANY in an event filter rule it won't match addresses in that range.