Security Object Group

Security Object Groups combine ip addresses, FQDNs, ports, and geolocations into reusable security match criteria. They can reference existing IPv4 and IPv6 security data prefix lists by name. Requires SD-WAN Manager 20.18.2 or later.

Diagram

Classes

sdwan

Name	Type	Constraint	Mandatory	Default Value
feature_profiles	Class	feature_profiles	No

feature_profiles (sdwan)

Name	Type	Constraint	Mandatory	Default Value
policy_object_profile	Class	policy_object_profile	No

policy_object_profile (sdwan.feature_profiles)

Name	Type	Constraint	Mandatory	Default Value
security_object_groups	List	security_object_groups	No

security_object_groups (sdwan.feature_profiles.policy_object_profile)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[^&<>! "]{1,32}$	Yes
description	String		No
data_ipv4_prefix_lists	List	String[Regex: ^[^&<>! "]{1,32}$]	No
data_ipv4_prefixes	List	IP	No
data_ipv4_prefixes_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
data_ipv6_prefix_lists	List	String[Regex: ^[^&<>! "]{1,32}$]	No
data_ipv6_prefixes	List	IP	No
data_ipv6_prefixes_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
fqdn_lists	List	String[Regex: ^[^&<>! "]{1,32}$]	No
fqdns	List	String[Regex: ^(?=.{1,120}$)((\*|[a-zA-Z0-9-]{1,63})\.)+([a-zA-Z0-9-]{2,63})$]	No
fqdns_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
geo_location_lists	List	String[Regex: ^[^&<>! "]{1,32}$]	No
geo_locations	List	Choice[AF, AN, AS, EU, NA, OC, SA, AFG, ALB, ATA, DZA, ASM, AND, AGO, ATG, AZE, ARG, AUS, AUT, BHS, BHR, BGD, ARM, BRB, BEL, BMU, BTN, BOL, BIH, BWA, BVT, BRA, BLZ, IOT, SLB, VGB, BRN, BGR, MMR, BDI, BLR, KHM, CMR, CAN, CPV, CYM, CAF, LKA, TCD, CHL, CHN, TWN, CXR, CCK, COL, COM, MYT, COG, COD, COK, CRI, HRV, CUB, CYP, CZE, BEN, DNK, DMA, DOM, ECU, SLV, GNQ, ETH, ERI, EST, FRO, FLK, SGS, FJI, FIN, ALA, FRA, GUF, PYF, ATF, DJI, GAB, GEO, GMB, PSE, DEU, GHA, GIB, KIR, GRC, GRL, GRD, GLP, GUM, GTM, GIN, GUY, HTI, HMD, VAT, HND, HKG, HUN, ISL, IND, IDN, IRN, IRQ, IRL, ISR, ITA, CIV, JAM, JPN, KAZ, JOR, KEN, PRK, KOR, KWT, KGZ, LAO, LBN, LSO, LVA, LBR, LBY, LIE, LTU, LUX, MAC, MDG, MWI, MYS, MDV, MLI, MLT, MTQ, MRT, MUS, MEX, MCO, MNG, MDA, MNE, MSR, MAR, MOZ, OMN, NAM, NRU, NPL, NLD, ANT, CUW, ABW, SXM, BES, NCL, VUT, NZL, NIC, NER, NGA, NIU, NFK, NOR, MNP, UMI, FSM, MHL, PLW, PAK, PAN, PNG, PRY, PER, PHL, PCN, POL, PRT, GNB, TLS, PRI, QAT, REU, ROU, RUS, RWA, BLM, SHN, KNA, AIA, LCA, MAF, SPM, VCT, SMR, STP, SAU, SEN, SRB, SYC, SLE, SGP, SVK, VNM, SVN, SOM, ZAF, ZWE, ESP, SSD, ESH, SDN, SUR, SJM, SWZ, SWE, CHE, SYR, TJK, THA, TGO, TKL, TON, TTO, ARE, TUN, TUR, TKM, TCA, TUV, UGA, UKR, MKD, EGY, GBR, GGY, JEY, IMN, TZA, USA, VIR, BFA, URY, UZB, VEN, WLF, WSM, YEM, ZMB]	No
ip_type	Choice	ipv4, ipv6	No	ipv4
port_lists	List	String[Regex: ^[^&<>! "]{1,32}$]	No
ports	List	Integer[min: 0, max: 65535]	No
ports_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No

Examples

Example-1: This object group combines a ipv4 subnet, destination name, and HTTPS port in one object. Respective security policy objects could also be referenced through data_ipv4_prefix_lists, data_ipv6_prefix_lists, fqdn_lists, geo_location_lists, or port_lists here instead of direct values for that criterion.

sdwan:
  feature_profiles:
    policy_object_profile:
      security_object_groups:
        - name: trusted-web
          ip_type: ipv4
          data_ipv4_prefixes:
            - 10.130.0.0/24
          fqdns:
            - example.com
          ports:
            - 443