| Chapter 11. IP Groups | ||
|---|---|---|
 |  | |
| Chapter 11. IP Groups | ||
|---|---|---|
| | | |
Table of Contents
There are many places in the FB9000 configuration where a set of IP addresses and ranges are required. For instance a service allow list or a firewall rule can have this type of input. In many instances you may refer to a named set of IPs and ranges, which we call an IP group.
For example, it can be useful to have a set of IPs that are defined as admin-machines that you can refer to throughout the configuration but which is defined in one place.
Sometimes you might even want to use it when there is only a single IP address to provide an alias for readability.
It is also possible to put the name of a subnet in such fields, which will translate to the IP range represented by that subnet.
This even applies to subnets created by DHCP.
However if there is an ip-group definition with the same name then that will take precedence.
There are various mechanisms for adding IPs and ranges to an ip-group. The group will consist of the union of all requested sources.
This is the most straightforward way to add IPs and ranges to a group. You can put them in a space separated list in the ip attribute of an ip-group definition.
The A and AAAA records associated with a given host may also be added to the group via the list of dns items.
If you add IPs by this mechanism, they'll not appear if DNS goes away or is compromised. Therefore we recommend having at least one fixed "escape hatch" IP when using this for allow lists.
A whitespace separated list of IPs and ranges may be loaded via HTTP(S). This format was chosen due to its simplicity and that due to support in other similar products there are existing lists for various purposes.
A url item should be added for each one you wish to fetch, and this configuration item gives options to control various parameters of how often and from where the fetching occurs.
If a fetch fails then the data from the last successful fetch will continue to be used until it can be retreived again.
IP groups can also list one or more user names in the users attribute and implicitly include the
current IP address from which those users are logged in to the web interface. This can be useful for firewall
rules where you may have to log in to the FireBrick, even as a NOBODY level user, just to get your IP address
in an access list to allow further access to a network from that IP.
| | | |
| 10.2. Creating/editing profiles |  | Chapter 12. Traffic Shaping |