Address Groups

Configuration > Templates & Policies > ACLs > Address Groups

Use the Address Groups tab to view and manage address groups in your SD-WAN network. An address group is a logical collection of IP hosts or subnets that can be referenced in source or destination matching criteria in the zone based firewall and security policies (route, QOS, optimization, and so forth).

NOTE:协调器支持多达500个地址组。

Add an Address Group

Follow the steps below to create a new address group:

1. ClickAdd Groupto open the Add Address Group dialog box.

   

2. Provide the following details in the fields provided:

   Field	德scription
   Group name	Enter a unique name for the group, up to 64 characters long. NOTE:Group names can only contain uppercase and lowercase letters, numbers, dots, underscores, and hyphens.
   IPs to include	Enter one or more IP addresses or subnets to include in the group (seeAddress Group Formatsbelow).
   IPs to exclude	Enter one or more IP addresses to exclude, in the case where you are including an IP range.
   Groups to include	Enter the name of one or more address groups to include. NOTE:Group inclusion only supports two levels of nesting. For example, if Group1 includes Group2 and Group2 includes Group3, you could not include Group1 anywhere because it already contains two levels of nested groups.
   Comment	Enter an optional comment that describes the address group and how it might be used.

3. ClickAddto create the address group, or clickCancelto close the dialog box without making any changes.

Add a Rule to an Address Group

Follow the steps below to add a rule to an existing address group:

1. Select the address group to which you want to add a rule from the drop-down list above the table.

2. ClickAdd Ruleto open the Add Rule dialog box.

   

3. Provide the details for the new rule in the fields provided (see field descriptions inAdd an Address Group).

4. ClickAddto create the rule or clickCancelto close the dialog box without making any changes.

删除an Address Group

Follow the steps below to delete an address group:

1. Select the address group you want to delete from the drop-down list above the table.

2. Click删除Group.

   A confirmation dialog box opens.

3. Click删除to confirm your choice and permanently remove the selected group and all of its rules. Otherwise, clickCancelto return to the list without deleting the group.

Export Address Groups

You can export the current address groups to a CSV file as a backup to make bulk modifications outside of the Orchestrator UI.

To export address groups:

1. ClickExport CSV.

2. In the save dialog box, browse to the location where you want to save the file, provide a name for the file, and then clickSave.

3. Open the saved file in Excel or another program to view or modify its contents.

   

   NOTE:When editing exported rules and address groups, you can modify the included or excluded IPs, included groups, or comments to overwrite the same rule when imported. If you modify the group name on a rule, however, it will create a new rule when imported.

Import Address Groups

To import address groups from a CSV file:

NOTE:You can import a file that was exported and modified, or a new file that contains data in the same rows and columns as the exported file. Columns are ordered as Name, Included IPs, Excluded IPs, Included Groups, and Comment. The first row of the import file will be ignored.

1. ClickBulk Importto open the Address Groups - Bulk Upload dialog box.

   

2. ClickChoose File, locate and select the CSV file to be imported, and then clickOpen.

3. Review the groups and rules to be imported.

4. ClickSaveto import the file and merge with or replace the existing address groups, or clickCancelto close the dialog box without making any changes.

View a Single Address Group

By default, all address groups are displayed in the table on the Address Groups tab. To filter the table to a single address group, select the group from the drop-down list above the table.

NOTE:You can only add rules to an existing group when viewing a single address group. You cannot add a group with the same name as an existing group.

Edit or Delete a Rule

To edit or delete an existing rule, click the edit icon to the right of the rule. The Edit Rule dialog box opens.

• To edit the rule, modify the available fields, and then clickSave.

• To delete the rule, click删除.

Using Address Groups in Match Criteria

When specifying match criteria for IP/Subnet, you can use an address group by enabling theSrc:DestandGroupsoptions.

Address Group Formats

An address group can include IP addresses, subnets, address groups, or any combination thereof. For IPs and subnets, the following formats are allowed:

• One or more IP addresses: 10.10.10.1 or 10.10.10.2, 10.10.10.2, 10.10.10.3

• IP subnet: 10.10.0.0/16 or 10.10.0.0/255.255.0.0

• IP range: 10.10.10.10-20

• IP range and subnet: 10.10-20.0.0/16, 10.10-20.0.0/255.255.0.0

• IP wildcard: 10.10.10.* (you can use the wildcard in any octet)

• Wildcard and mask: 10.*.0.0/16, 10.*.0.0/255.255.0.0

---