Unique? Non-Unique? What to choose?

[J_Saun]

I am trying to change the following network object:

10.188.172.0/24

to

10.188.172.0/23

I receive the following error/pop-up:

"This IPv4 address is unique and already used by one or more networks in the system. Would you like to define this network's IPv4 addresses as non-unique?"

What does that mean and what do I choose? I do already have another object that is 10.188.173.0/24. Is that the conflict?

[Maarten_Sjouw]

When you this message it simply means there is already a object with the exact same network (IP and Mask).

So if you choose to make it non-unique it will create the duplicate, only thing is that you have it with a different name.

How did this happen you might think, well when you do a get interfaces WITH topology the SmartConsole will create a network object for every route that you have. Same goes for VSX when you add a route a new network object is created.

The problem with these objects is that they are partially hidden, you can add them on a rule, but you dont see them in the object explorer.

Hope this helps.

[J_Saun]

What additional implications or possible issues does making an object non-unique have?

[Maarten_Sjouw]

Sometimes there are reasons to create a host with the same IP as a gateway, specially when creating some very specific NAT rules. For most other reasons you should try to stay away from creating them and use the existing object instead.

[J_Saun]

Still confused. I get the following additional error after saying YES to object 10.188.172.0/24 being non-unique:

"There are one or more non-unique address ranges contained in this range. Would you like to replace the existing ranges by this one?"

Some additional background:

I have 2 network objects:

- Network_10.188.172.0_24_WEB (10.188.172.0/24). It is used in about 10 rules

- Net_10.188.172.0_23 (10.188.172.0/23). It is used in an interface antispoofing group.

I would prefer to have the 2 network objects as the one is labelled properly for the rules and the other is labelled properly for the antispoof group. But I guess best practice would dictate to only have one.

[Maarten_Sjouw]

The point here is that the Net_10.188.172.0_23  was created by the 'Get interfaces WITH Topology' function, the way this is created is that is partially invisible. Having said that, this error / warning should not appear with these 2 networks as  the one is a /23 and the other is a /24 next to that the name is different.

For anti Spoofing you need the full range that lives behind a specific interface, but for the access rules you sometimes need a smaller subnet, like a /25 to give it specific access to something.

Are these objects real network objects or are they address ranges objects as it says in your error message?

[J_Saun]

Both networks were created manually as they were not part of the original topology of the environment, and then the /23 was added to the antispoofing group. Multiple admins have worked on this policy since its inception and one of them created the /23 for the antispoofing, then later a request was made to use the /24's in the policy. We are now doing a cleanup of the policy and it's been requested to make the /24 a /23 - then we get the error about non-unique.

I guess I will just rename the /23 to something more appropriate and put it in each rule that has the /24 currently (and remove the /24 from the rule as well) as the desire is to have the /23 in the rules (not 2 /24's).

[Maarten_Sjouw]

The thing here is that it should not nag about this as they have different subnet masks and should not be seen as the same.

Ohh wait a minute, you are on R77.30 AND you have SmartMap turned on, don't you?

Go into global preferences and in the SmartMap page turn it OFF!!

Sorry, needed to scroll back and reread your original question. You have a net/24 and you have another net/23 and you want to change the Net/24 to Net/23 and then it starts nagging.

Ok here is what you do:

• Change the /23 object to set it to another network ie change the 10 to 100
• Change the /24 object to the wanted /23
• Open the anti spoofing group and replace the old /23 with the correct /23
• Delete the original /23

Done.