Dynamic Object Sourced from Physical Interface

cancel
Showing results for 
Search instead for 
Did you mean: 

Dynamic Object Sourced from Physical Interface

L2 Linker

Is it possible to  create an object in panorama that can be reused in multiple templates that is literally just tied to the ip of an interface on that device?

 

For example, eth1/1 has address 1.1.1.1

Object should just reference eth1/1

Object can be used in template that can be reused for multiple devices.

2 ACCEPTED SOLUTIONS

Accepted Solutions

L7 Applicator

You can create object OUTSIDE.

On every firewall you have local object with same name but public IP of specific location.

On ethernet1/1 you assign object OUTSIDE as IP.

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI

View solution in original post

If you don't need interface IP to be object replace it back with regular IP and change object to /32.

If you do need then create 2 objects. One for interface with /29 and other for security policies with /32

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI

View solution in original post

4 REPLIES 4

L7 Applicator

You can create object OUTSIDE.

On every firewall you have local object with same name but public IP of specific location.

On ethernet1/1 you assign object OUTSIDE as IP.

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI

View solution in original post

I thought this was solved but after further testing, I'm not sure that it is solving the problem I'm running into specifically.

 

While being able to put an IP of say 1.1.1.1/29 in object 'external_interface'.  If i use the object 'external_interface' in a security policy rule, it hits on the whole subnet instead of the specific address i picked within the subnet.  Does this make sense?

 

Object is 1.1.1.1/29

Rules will hit 1.1.1.0 - 1.1.1.7

I only want rules to hit on 1.1.1.1

I need 1.1.1.1/29 for interface

If you don't need interface IP to be object replace it back with regular IP and change object to /32.

If you do need then create 2 objects. One for interface with /29 and other for security policies with /32

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI

View solution in original post

Yeap, that's what I was afraid of.  Trying to kill two birds with one stone but it doesn't look like it's possible.  Thanks!

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!