Dynamic Object Sourced from Physical Interface

[Brett.Hoshaw]

Is it possible to  create an object in panorama that can be reused in multiple templates that is literally just tied to the ip of an interface on that device?

For example, eth1/1 has address 1.1.1.1

Object should just reference eth1/1

Object can be used in template that can be reused for multiple devices.

[Raido_Rattameister · Accepted solution]

You can create object OUTSIDE.

On every firewall you have local object with same name but public IP of specific location.

On ethernet1/1 you assign object OUTSIDE as IP.

[Brett.Hoshaw]

I thought this was solved but after further testing, I'm not sure that it is solving the problem I'm running into specifically.

While being able to put an IP of say 1.1.1.1/29 in object 'external_interface'.  If i use the object 'external_interface' in a security policy rule, it hits on the whole subnet instead of the specific address i picked within the subnet.  Does this make sense?

Object is 1.1.1.1/29

Rules will hit 1.1.1.0 - 1.1.1.7

I only want rules to hit on 1.1.1.1

I need 1.1.1.1/29 for interface

[Raido_Rattameister · Accepted solution]

If you don't need interface IP to be object replace it back with regular IP and change object to /32.

If you do need then create 2 objects. One for interface with /29 and other for security policies with /32

[Brett.Hoshaw]

Yeap, that's what I was afraid of.  Trying to kill two birds with one stone but it doesn't look like it's possible.  Thanks!