Cisco to Fortinet Overcomplication with objects and IPs

[dcapone2004]

I am new to Fortinet / Fortigate and come from a Cisco background.  I am considering swapping a Cisco firewall with a Fortigate firewall, however, there is 1 big roadblock stopping me from doing so.

The Cisco firewall in question has a relatively complex set of VPN tunnels that tunnel only to a list of specific IP addresses.  This is essentially to allow a more secure configuration of only allowing a single IP to access certain services across a national footprint from several small offices that only have dynamic IP internet services.  Rather than have X user per site all need to use a VPN client to individually to tunnel to the specific destinations, permanent tunnels are in place at each location that tunnels only traffic to the "protected" services for ease of access.  Each office also has a slightly different list of IPs it can access.

On the cisco I basically have 4 different object-groups each with the correct list of IPs in them.  Where Fortinet seemingly makes things overly complicated is that there does not appear to be a way to create a group of IPs where the IP addresses are merely specified.  Fortigate seems to require that every IP used in a group FIRST have an INDIVIDUAL separate object created for it in order to place the IP address in a group.

I have a list of about 60 total IP addresses.  It seems extremely clunky/disorganized to have to create 60 objects for IP addresses that will NEVER be referenced outside of the object group.

I am hoping that I am missing something and there is a more straightforward way that makes more sense to do this on the Fortigate.

[distillednetwork]

Are you trying to use the list of IPs just in Firewall policies or in the VPN setup? 

If it's just a firewall policy, then you don't necessarily have to create a group, especially since you have IP reuse but not the exact same groups.  

You can also automate the generation of the IP addresses and groups but setting up an external Connector (under Security Fabric) that will pull in the list of addresses and create the group  from an external feed (HTTP) or by doing an API push to it.  I often use this for larger lists of IP addresses i need to maintain across multiple firewalls too.

[Toshi_Esumi]

You're right about "Fortigate seems to require that every IP used in a group FIRST have an INDIVIDUAL separate object created for it in order to place the IP address in a group".
With FortiGate an address group is a collection of address objects, which include ipmask, iprange, fqdn, geography, etc. You can not put IPs directly into an address group.
But that shouldn't be a "roadblock" for migration. It's just a different software or software architecture. For only 60 objects, you can easily script up command lines for config firewall address and config firewall addrgrp then paste into it.
Any access restrictions, you need to use policies as @distillednetwork mentioned.

Toshi

[dcapone2004]

Hi,

distillednetwork, this is not for firewall policy, but for VPN "interesting traffic" description.

Toshi,

You are correct in that "roadblock" may have been too strong of a word because it is possible to implement.  My primary point was that it seems to create an overly long configuration with a lot of waste.  To me that makes it harder to manage because instead of having 4 object-groups and maybe 7 true "objects" to deal with and page through when I need a refresh on the current configuration before making further changes, I now have to deal with 60 EXTRA objects.  Additionally in the places where the object-groups are used in the configuration, I need to cross-reference against 60 objects to see what IPs they refer to.  That is the part I am concerned about.

Instead of looking at the config and seeing:

config firewall addrgrp
edit "My IPs"
set uuid abc

set member "192.168.1.6" "192.168.24.51" "172.17.50.16" "10.25.15.123" "10.100.0.0/24"

I get to see

set member "OBJ1" "OBJ2" "OBJ3" "OBJ4"

I guess the solution is to name objects that have minimal meaning outside of their IP addresses to include the IP address like:

NOBJ_192.168.1.6

NOBJ_192.168.24.51

NOBJ_172.17.50.16

NOBJ_192.25.15.123

NOBJ_10.100.0.0-24

Is this current best practice for Fortinet?  Otherwise, how do you handle these type of "redundant" objects for long-term manageability?

[Toshi_Esumi]

You should create host IP, subnet objects with more meaningful name, so that anybody understand what each means, and you don't have to change the name of object when IP adress/subnet changes. 
We use nested address group objects a lot.

config firewall address
   edit "AndrewB PC"
     (set type ipmask)    <- default value
       set subnet 192.168.1.100 255.255.255.255

   next
   edit AcctSvr-net
     (set type ipmask)
       set subnet 10.100.0.0 255.255.255.0

   next
end

config firewall addrgrp 
   edit "AcctDept PCs"
      set member "AndrewB PC" "BonnieM PC" ....
   next

    ...

   edit "AcctDept"
       set member "AccDept PCs"  "AcctSvr-net" ....

   next

end

Toshi