Nesting Variables
You can nest variables so long as the nesting is not circular. Nested, negated variables are not supported.
Valid Nested Variables
In this example, SMTP_SERVERS, HTTP_SERVERS, and OTHER_SERVERS are valid nested variables.
|
Variable |
Type |
Included Networks |
Excluded Networks |
|---|---|---|---|
|
SMTP_SERVERS |
customized default |
10.1.1.1 |
— |
|
HTTP_SERVERS |
customized default |
10.1.1.2 |
— |
|
OTHER_SERVERS |
user-defined |
10.2.2.0/24 |
— |
|
HOME_NET |
customized default |
10.1.1.0/24 OTHER_SERVERS |
SMTP_SERVERS HTTP_SERVERS |
An Invalid Nested Variable
In this example, HOME_NET is an invalid nested variable because the nesting of HOME_NET is circular; that is, the definition of OTHER_SERVERS includes HOME_NET, so you would be nesting HOME_NET in itself.
|
Variable |
Type |
Included Networks |
Excluded Networks |
|---|---|---|---|
|
SMTP_SERVERS |
customized default |
10.1.1.1 |
— |
|
HTTP_SERVERS |
customized default |
10.1.1.2 |
— |
|
OTHER_SERVERS |
user-defined |
10.2.2.0/24 HOME_NET |
— |
|
HOME_NET |
customized default |
10.1.1.0/24 OTHER_SERVERS |
SMTP_SERVERS HTTP_SERVERS |
An Unsupported Nested, Negated Variable
Because nested, negated variables are not supported, you cannot use the variable NONCORE_NET as shown in this example to represent IP addresses that are outside of your protected networks.
|
Variable |
Type |
Included Networks |
Excluded Networks |
|---|---|---|---|
|
HOME_NET |
customized default |
10.1.0.0/16 10.2.0.0/16 10.3.0.0/16 |
— |
|
EXTERNAL_NET |
customized default |
— |
HOME_NET |
|
DMZ_NET |
user-defined |
10.4.0.0/16 |
— |
|
NOT_DMZ_NET |
user-defined |
— |
DMZ_NET |
|
NONCORE_NET |
user-defined |
EXTERNAL_NET NOT_DMZ_NET |
— |
Alternative to an Unsupported Nested, Negated Variable
As an alternative to the example above, you could represent IP addresses that are outside of your protected networks by creating the variable NONCORE_NET as shown in this example.
|
Variable |
Type |
Included Networks |
Excluded Networks |
|---|---|---|---|
|
HOME_NET |
customized default |
10.1.0.0/16 10.2.0.0/16 10.3.0.0/16 |
— |
|
DMZ_NET |
user-defined |
10.4.0.0/16 |
— |
|
NONCORE_NET |
user-defined |
— |
HOME_NET DMZ_NET |