How can I quickly move from many objects in many rules to a reusable group?

Tomer_Sole — Tue, 21 Nov 2017 16:48:54 GMT

Today I have multiple policies holding exactly the same set of objects (access roles/networks/hosts..) over and over in multiple rules. Due to scaling demands I keep adding more hosts to all those places.

How can R80.10 help me with making my management operations more efficient?

Re: How can I quickly move from many objects in many rules to a reusable group?

Tomer_Sole — Tue, 21 Nov 2017 17:04:35 GMT

We started hearing more about this case from customers, so I wanted to use this platform to demonstrate a suggestion for this.

It probably makes sense to use a group and reuse that one group across the many rules. It can reduce mistakes, and save time. R80.10 SmartConsole provides good audit logs about changes within the install policy dialog, in the audits overview, and on each rule using the 1-click Rule Objects Logs.

So how do we move to a group-oriented policy?

Step 1:

Do a "where used" on one of the repeating objects.

Step 2:

In the Where Used dialog, choose to replace this object with a new group.

Step 3:

Add to that new group this searched object, as well as the other objects which you want to avoid repeating over and over and group them instead.

Tip: within the group members picker, use the filter icon to filter based on a specific category. In this case, all of our group members will be some of the Networks, so we can quickly get rid of the rest of the objects that show up in the picker by filtering on the Network category.

Step 4:

Add the remaining repeating objects to the group.

Step 5:

Click OK on the group dialog to automatically save these changes (on your private session, no one else sees them just yet)

Click Replace on this replacement from the where-used dialog.

Step 6:

For any object of the group members, find it on the Objects Bar or Objects Explorer, click on "Where Used", and replace it with "None (remove item)". Check the check-boxes near all the usage locations in which you included the group that contains this object (in step 5).

Click "Replace" to approve the replacement.

Repeat this step for the rest of the objects which you have contained within the group. After this, you will officially move from a "repeat yourself with many objects" approach to a "reusable group" approach.

topic How can I quickly move from many objects in many rules to a reusable group? in Firewall and Security Management