Object groups

An object group is a configuration grouping that

  • enables referencing multiple objects with a single configuration,

  • allows objects and object groups to be used interchangeably in the web interface, and

  • supports grouping of network, port, VLAN tag, URL, and PKI objects.

Object group usage and management

The system allows you to use objects and object groups interchangeably in the web interface. For example, anywhere you would use a port object, you can also use a port object group.

Network object groups can be nested. You can add a network object group to another network object group, up to 10 levels deep.

Objects and object groups of the same type cannot have the same name.

Edit an object group used in a policy, such as a network object group in an access control policy. Then, re-deploy the configuration for your changes to take effect.

Deleting a group does not delete the objects in the group; only their association with each other. Additionally, you cannot delete a group that is in use in an active policy. For example, you cannot delete a VLAN tag group that is used in a VLAN condition in a saved access control policy.

Object references and literal entries in object groups

Object groups can contain either object references or literal entries.

  • Object references are links to existing Host/Network Objects. When the original object is modified (for example, an IP address change), all object groups containing references to that object are automatically updated to reflect the change.

  • Literal entries are manually created entries within an object group. Unlike object references, literal entries are independent configuration entities and are not dynamically linked to existing Host/Network Objects. Therefore, changes made to a Host/Network Object do not propagate to object groups containing literal entries.

For example, an administrator may manually add a literal entry with the same name and IP address as an existing Host/Network Object. Although the entries appear identical, the literal entry remains independent of the original object. If the original Host/Network Object is modified, only object groups containing a reference to that object are updated.

Modifying a Host/Network Object updates only those object groups that contain a reference to that object. Object groups containing literal entries continue to display their original configuration unless the literal entries are manually modified.