Nesting variables
A nesting variable is a configuration element that
-
can include other variables as part of its definition
-
does not support circular nesting, and
-
does not support nested, negated variables.
Valid nested variables
In this example, SMTP_SERVERS, HTTP_SERVERS, and OTHER_SERVERS are valid nested variables.
|
Variable |
Type |
Included Networks |
Excluded Networks |
|---|---|---|---|
|
SMTP_SERVERS |
customized default |
10.1.1.1 |
— |
|
HTTP_SERVERS |
customized default |
10.1.1.2 |
— |
|
OTHER_SERVERS |
user-defined |
10.2.2.0/24 |
— |
|
HOME_NET |
customized default |
10.1.1.0/24 OTHER_SERVERS |
SMTP_SERVERS HTTP_SERVERS |
Invalid nested variable
In this example, HOME_NET is an invalid nested variable because the nesting of HOME_NET is circular; that is, the definition of OTHER_SERVERS includes HOME_NET, so you would be nesting HOME_NET in itself.
|
Variable |
Type |
Included Networks |
Excluded Networks |
|---|---|---|---|
|
SMTP_SERVERS |
customized default |
10.1.1.1 |
— |
|
HTTP_SERVERS |
customized default |
10.1.1.2 |
— |
|
OTHER_SERVERS |
user-defined |
10.2.2.0/24 HOME_NET |
— |
|
HOME_NET |
customized default |
10.1.1.0/24 OTHER_SERVERS |
SMTP_SERVERS HTTP_SERVERS |
Unsupported nested, negated variable
Because nested, negated variables are not supported, do not use the variable NONCORE_NET to represent IP addresses outside your protected networks.
|
Variable |
Type |
Included Networks |
Excluded Networks |
|---|---|---|---|
|
HOME_NET |
customized default |
10.1.0.0/16 10.2.0.0/16 10.3.0.0/16 |
— |
|
EXTERNAL_NET |
customized default |
— |
HOME_NET |
|
DMZ_NET |
user-defined |
10.4.0.0/16 |
— |
|
NOT_DMZ_NET |
user-defined |
— |
DMZ_NET |
|
NONCORE_NET |
user-defined |
EXTERNAL_NET NOT_DMZ_NET |
— |
Alternative to unsupported nested, negated variable
As an alternative to the example above, you could represent IP addresses that are outside of your protected networks by creating the variable NONCORE_NET to represent IP addresses outside your protected networks.
|
Variable |
Type |
Included Networks |
Excluded Networks |
|---|---|---|---|
|
HOME_NET |
customized default |
10.1.0.0/16 10.2.0.0/16 10.3.0.0/16 |
— |
|
DMZ_NET |
user-defined |
10.4.0.0/16 |
— |
|
NONCORE_NET |
user-defined |
— |
HOME_NET DMZ_NET |