FMG: Use address objects in VIP object

[Toshi_Esumi]

We currently run v6.4.10 for our FMG-VM and manage bigger customer's FortiGates(FGTs) totalling about 600 (soon to be 800+).

And one of them needs one VIP group (two VIPs) at all 500+ locations. We use policy packages for this customer to standardize their policies, which is almost the same at all locations.

But when I looked at the VIP object config under Policy&Objects->Object Configurations->Firewall Objects->Virtual IPs then hit "Create New->Virtual IP", I don't see a way to select a dynamic address object for the External IP and Mapped IP.

This means we need to create 500+ x 2 VIPs manually putting each IP, then worse, we need to create 500+ different policies and use "Installation Target" to be for one specific FGT.

Is there a better way to have just one policy for one VIP group for 500+ FGTs?

Or, can I use meta fields+CLI template to define those on Device DB side and somehow let the policy to refer to the VIP group name? 

There should be a better way to do this, right?

Thanks,

Toshi

[gfleming · Accepted solution]

I mean you can't use address objects in a VIP config on the FortiGate so why would you be able to on the FMG? 

Also you have to create unique entries already because each location likely requires a unique IP address for the VIP? So that's gonna be a lot of work anyway regardless of using objects or not.

There is a decent way of doing this though:

1. Create the VIP to be shared in the policy package.
2. Either use per-device mapping for each site to edit the appropriate IP addresses or,
3. Use meta fields as you suggested and input the variable for the IP address in the VIP

[Toshi_Esumi]

Ok, my screen on the laptop was too small and I didn't scroll down all the way to the bottom to see "Per-device Mapping" ON/Off sliding switch. So VIPs can be actually dynamic objects I can configure different IP per-device. I'll use this feature.

I was thinking the meta fields method would probably work using a CLI template to define VIP config in Device DB instead of an object in the Policy&Object. But it might at least confuse our techs and might cause conflict when someone who doesn't know about the CLI template tries to create a VIP in the object DB temporarily to test something at one of locations.

In any case, I now see what you're explaining.

Thanks,

Toshi