policy network group nocroon 172.x.x.0 mask 255.255.255.0 policy network group self1 172.x.x.0 mask 255.255.255.0 policy condition self1_to_nocroom source network group self1 destination network group nocroom policy action Deny disposition deny policy action Permit policy rule deny_self1 precedence 100 condition self1_to_nocroon