How to Create IA Access Role with Multi Src,Dst IP-Address?

[Security_Consul]

Hi 

I have planned to integrate Identity Awareness for Large Scale with existing production firewall, we have existing 1700+ Rule with "networks, service object" So my target is Add "AD User, Networks, Service object on the top of existing rule with new rule for Monitoring before migrate to New Rule with Access role.

Example Existing Rule

Source IP have 20+ Object, Destination IP 20+ Object

If possible don't change behavior for my customer admin to manage their firewall. existing behavior admin can verify src,dst IP its just look at the rule because src,dst shown on the rule. In the feature admin have to double click on "access-role" for check src,dst IP some thing like that. 

My English skill is not so good, But I'm try to explain!

GIAG R80.30

[PhoneBoy]

An Access Role can incorporate one or more of the following:

• Username
• Host (as registered to Active Directory)
• Specific Source IP or Network
• Remote Access Client (from R80.10)

Access Roles can be used in a Source or Destination in a role.
However, you can't mix "regular" network objects and Access Roles in the same source/destination cell, discussed here: https://community.checkpoint.com/t5/Policy-Management/Policy-verification-failed-for-rule-with-netwo...
This might mean duplicating some of your existing rules.

[Security_Consul]

Its only way to create access role rule just add everything need to consider of the rule into 1 access role object (Network Object, AD User) 

May be add more one access role object 

But my target no need to change admin's behavior.