topic Dynamic Object Sourced from Physical Interface in General Topics

Dynamic Object Sourced from Physical Interface

Brett.Hoshaw — Fri, 05 Apr 2019 14:59:18 GMT

Is it possible to create an object in panorama that can be reused in multiple templates that is literally just tied to the ip of an interface on that device?

For example, eth1/1 has address 1.1.1.1

Object should just reference eth1/1

Object can be used in template that can be reused for multiple devices.

Re: Dynamic Object Sourced from Physical Interface

Raido_Rattameister — Fri, 05 Apr 2019 15:21:02 GMT

You can create object OUTSIDE.

On every firewall you have local object with same name but public IP of specific location.

On ethernet1/1 you assign object OUTSIDE as IP.

Re: Dynamic Object Sourced from Physical Interface

Brett.Hoshaw — Fri, 05 Apr 2019 19:32:54 GMT

I thought this was solved but after further testing, I'm not sure that it is solving the problem I'm running into specifically.

While being able to put an IP of say 1.1.1.1/29 in object 'external_interface'. If i use the object 'external_interface' in a security policy rule, it hits on the whole subnet instead of the specific address i picked within the subnet. Does this make sense?

Object is 1.1.1.1/29

Rules will hit 1.1.1.0 - 1.1.1.7

I only want rules to hit on 1.1.1.1

I need 1.1.1.1/29 for interface

Re: Dynamic Object Sourced from Physical Interface

Raido_Rattameister — Fri, 05 Apr 2019 19:36:13 GMT

If you don't need interface IP to be object replace it back with regular IP and change object to /32.

If you do need then create 2 objects. One for interface with /29 and other for security policies with /32

Re: Dynamic Object Sourced from Physical Interface

Brett.Hoshaw — Fri, 05 Apr 2019 19:38:19 GMT

Yeap, that's what I was afraid of. Trying to kill two birds with one stone but it doesn't look like it's possible. Thanks!