how to allow a special ip to be allowed, that ip is in the blocked ip range

[cuong955]

Hi everyone
Please help me this case
i have 2 vlan
vlan 10 : 10.0.10.0/24
vlan 20 : 10.0.20.0/24

Code: Select all

policy network group "vlan10"  10.10.0.10.0 mask 255.255.255.0
policy network group "vlan20"  10.10.0.20.0 mask 255.255.255.0

policy action accept
policy action deny disposition deny

policy condition "vlan10-to-vlan20" source vlan 10 destination network group vlan20
policy rule "vlan10-to-vlan20" condition "vlan10-to-vlan20" action deny
qos apply

it work and now i want to allow a ip in vlan 10 (10.0.10.2) and range (10.0.10.11-20) can access to vlan 20
please help me config it

thanks so much

[silvio]

create a new network group with this IP's and a condition for this.
Than a rule for this condition with action accept. But the most important thing is, tha this rule need a higher precedence (greater than default 1).