Network variables

A network variable is a configuration element that

  • represents IP addresses for use in intrusion rules, intrusion policy rule suppressions, dynamic rule states, and adaptive profile updates

  • differs from network objects and network object groups by being specific to intrusion policies and intrusion rules, and

  • enables specification of host IP addresses in various configurations within an intrusion policy.

Network variable usage and configuration

Network variables can be used to specify the IP addresses of hosts on the network in the following configurations:

  • Intrusion rules: The Source IPs and Destination IPs fields restrict packet inspection to traffic originating from or destined to specific IP addresses.

  • Suppressions: The Network field in source or destination intrusion rule suppressions suppresses intrusion event notifications when a specific IP address or range triggers an intrusion rule or preprocessor.

  • Dynamic rule states: The Network field in dynamic rule states identifies when too many matches for an intrusion rule or preprocessor occur within a given time period.

  • adaptive profile updates: TheNetworks field identifies hosts where packet fragment and TCP stream reassembly is improved in passive deployments.

When variables are used in these fields, the variable set linked to an intrusion policy determines the variable values applied to network traffic handled by the related access control policy.

A variable can include any combination of the following network configurations:

  • network variables, network objects, and network object groups selected from the available networks list,

  • individual network objects added from the New or Edit Variable page, which can then be used in variables or other configurations,

  • literal single IP addresses or address blocks; multiple literal IP addresses and address blocks may be included individually, supporting both IPv4 and IPv6 addresses.

    When specifying IPv6 addresses, any addressing convention defined in RFC 4291 may be used.

The default value for included networks in any variable is any, which indicates any IPv4 or IPv6 address. The default value for excluded networks is none, meaning no network. If you specify the address ::, it means any IPv6 address when included, or no IPv6 addresses when excluded.

Adding networks to the excluded list negates those addresses and blocks; all addresses except the excluded ones can be matched.

For example, excluding 192.168.1.1 specifies any IP address other than 192.168.1.1. Excluding 2001:db8:ca2e::fa4cspecifies any IP address except 2001:db8:ca2e::fa4c.

Exclusions can be made with any combination of literal or available networks. For instance, excluding both 192.168.1.1 and 192.168.1.5 matches any IP address other than 192.168.1.1 or 192.168.1.5.

Keep these points in mind when you add or edit network variables:

  • The value any cannot be logically excluded, as it would mean no address; for example, it is not possible to add a variable with the value any to the exclusion list.

  • Network variables identify traffic for specific intrusion rule and intrusion policy features; preprocessor rules can trigger events regardless of the hosts defined by network variables.

  • Excluded values must resolve to a subset of included values; for example, including the address block 192.168.5.0/24 and excluding 192.168.6.0/24 is not valid.