Cisco to Fortinet Overcomplication with objects and IPs

Are you trying to use the list of IPs just in Firewall policies or in the VPN setup? 

If it's just a firewall policy, then you don't necessarily have to create a group, especially since you have IP reuse but not the exact same groups.  

You can also automate the generation of the IP addresses and groups but setting up an external Connector (under Security Fabric) that will pull in the list of addresses and create the group  from an external feed (HTTP) or by doing an API push to it.  I often use this for larger lists of IP addresses i need to maintain across multiple firewalls too.

You're right about "Fortigate seems to require that every IP used in a group FIRST have an INDIVIDUAL separate object created for it in order to place the IP address in a group".
With FortiGate an address group is a collection of address objects, which include ipmask, iprange, fqdn, geography, etc. You can not put IPs directly into an address group.
But that shouldn't be a "roadblock" for migration. It's just a different software or software architecture. For only 60 objects, you can easily script up command lines for config firewall address and config firewall addrgrp then paste into it.
Any access restrictions, you need to use policies as @distillednetwork mentioned.

Toshi

Hi,

distillednetwork, this is not for firewall policy, but for VPN "interesting traffic" description.

Toshi,

You are correct in that "roadblock" may have been too strong of a word because it is possible to implement.  My primary point was that it seems to create an overly long configuration with a lot of waste.  To me that makes it harder to manage because instead of having 4 object-groups and maybe 7 true "objects" to deal with and page through when I need a refresh on the current configuration before making further changes, I now have to deal with 60 EXTRA objects.  Additionally in the places where the object-groups are used in the configuration, I need to cross-reference against 60 objects to see what IPs they refer to.  That is the part I am concerned about.

Instead of looking at the config and seeing:

config firewall addrgrp
edit "My IPs"
set uuid abc

set member "192.168.1.6" "192.168.24.51" "172.17.50.16" "10.25.15.123" "10.100.0.0/24"

I get to see

set member "OBJ1" "OBJ2" "OBJ3" "OBJ4"

I guess the solution is to name objects that have minimal meaning outside of their IP addresses to include the IP address like:

NOBJ_192.168.1.6

NOBJ_192.168.24.51

NOBJ_172.17.50.16

NOBJ_192.25.15.123

NOBJ_10.100.0.0-24

Is this current best practice for Fortinet?  Otherwise, how do you handle these type of "redundant" objects for long-term manageability?