05-15-2018 11:13 AM
Hello,
I'm trying to identify what the best way of applying a list of datacenter IPs to one of our security policies. The list has about 150 IP's and I'm apparently unable to paste the list of IP's into an address group as it gives me an error notice stating static "IP" is not a valid reference for all the IP's in the list. Creating the options via GUI and CLI is an option it appears, but it seems really tedious having to generate the names and submit the entries. I'm probably missing something though. What's the best practice for this?
Thanks!
05-15-2018 12:07 PM
Hello,
If they are all in the same zone, then you wouldnt have to use IP's. Another thought would be to use subnets. You could download the XML config and add them in that way and then upload the XML back into your system.
Just a few thoughts.
05-15-2018 12:37 PM
Personally I think @OtakarKlier already mentioned the best possible solution, include them by directly modifying the XML and re-uploading it onto the box. Although it sounds like you could possibly benefit from putting these into a dynamic address-group and making it trigger on some sort of tag such as 'datacenter'. This allows you to quickly add members and remove them by simply creating the address object with the appropriate tag while maintaining the same security posture. Makes updating things a little bit smother as you only have to create/delete an address object instead of modifying a bunch of security policies.
05-16-2018 10:15 AM
The option I've been presented with is to use an External Dynamic list from a file hosted on a server on our trusted zone. This would essentially accomplish the same thing correct?
05-16-2018 10:58 AM
That was going to be my suggestion, if you have an internal webserver you can build an EDL. The only advantage this has over the "internal" dynamic list using a tag is that to add or remove IP addresses you only need a text editor. The disadvantage is you need a web server to host it.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
