topic Re: Best practice for applying list of IP's to a security policy. in General Topics

Best practice for applying list of IP's to a security policy.

kahbernie — Tue, 15 May 2018 18:13:39 GMT

Hello,

I'm trying to identify what the best way of applying a list of datacenter IPs to one of our security policies. The list has about 150 IP's and I'm apparently unable to paste the list of IP's into an address group as it gives me an error notice stating static "IP" is not a valid reference for all the IP's in the list. Creating the options via GUI and CLI is an option it appears, but it seems really tedious having to generate the names and submit the entries. I'm probably missing something though. What's the best practice for this?

Thanks!

Re: Best practice for applying list of IP's to a security policy.

OtakarKlier — Tue, 15 May 2018 19:07:48 GMT

Hello,

If they are all in the same zone, then you wouldnt have to use IP's. Another thought would be to use subnets. You could download the XML config and add them in that way and then upload the XML back into your system.

Just a few thoughts.

Re: Best practice for applying list of IP's to a security policy.

BPry — Tue, 15 May 2018 19:37:16 GMT

@kahbernie,

Personally I think @OtakarKlier already mentioned the best possible solution, include them by directly modifying the XML and re-uploading it onto the box. Although it sounds like you could possibly benefit from putting these into a dynamic address-group and making it trigger on some sort of tag such as 'datacenter'. This allows you to quickly add members and remove them by simply creating the address object with the appropriate tag while maintaining the same security posture. Makes updating things a little bit smother as you only have to create/delete an address object instead of modifying a bunch of security policies.

Re: Best practice for applying list of IP's to a security policy.

kahbernie — Wed, 16 May 2018 17:15:49 GMT

The option I've been presented with is to use an External Dynamic list from a file hosted on a server on our trusted zone. This would essentially accomplish the same thing correct?

Re: Best practice for applying list of IP's to a security policy.

JoeAndreini — Wed, 16 May 2018 17:58:48 GMT

That was going to be my suggestion, if you have an internal webserver you can build an EDL. The only advantage this has over the "internal" dynamic list using a tag is that to add or remove IP addresses you only need a text editor. The disadvantage is you need a web server to host it.

Re: Best practice for applying list of IP's to a security policy.

OtakarKlier — Wed, 16 May 2018 17:59:01 GMT

Yes it should.