Best practice for applying list of IP's to a security policy.

Reply
L1 Bithead

Best practice for applying list of IP's to a security policy.

Hello,

 

I'm trying to identify what the best way of applying a list of datacenter IPs to one of our security policies.  The list has about 150 IP's and I'm apparently unable to paste the list of IP's into an address group as it gives me an error notice stating static "IP" is not a valid reference for all the IP's in the list.  Creating the options via GUI and CLI is an option it appears, but it seems really tedious having to generate the names and submit the entries.  I'm probably missing something though.  What's the best practice for this?

 

Thanks!

L7 Applicator

Re: Best practice for applying list of IP's to a security policy.

Hello,

If they are all in the same zone, then you wouldnt have to use IP's. Another thought would be to use subnets. You could download the XML config and add them in that way and then upload the XML back into your system.

 

Just a few thoughts.

L7 Applicator

Re: Best practice for applying list of IP's to a security policy.

@kahbernie,

Personally I think @Otakar.Klier already mentioned the best possible solution, include them by directly modifying the XML and re-uploading it onto the box. Although it sounds like you could possibly benefit from putting these into a dynamic address-group and making it trigger on some sort of tag such as 'datacenter'. This allows you to quickly add members and remove them by simply creating the address object with the appropriate tag while maintaining the same security posture. Makes updating things a little bit smother as you only have to create/delete an address object instead of modifying a bunch of security policies. 

 

L1 Bithead

Re: Best practice for applying list of IP's to a security policy.

The option I've been presented with is to use an External Dynamic list from a file hosted on a server on our trusted zone.  This would essentially accomplish the same thing correct?

L4 Transporter

Re: Best practice for applying list of IP's to a security policy.

That was going to be my suggestion, if you have an internal webserver you can build an EDL.  The only advantage this has over the "internal" dynamic list using a tag is that to add or remove IP addresses you only need a text editor.  The disadvantage is you need a web server to host it.

L7 Applicator

Re: Best practice for applying list of IP's to a security policy.

Yes it should.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!