Definde Objects/groups

Question

Hello, 
 where can I create e.g. IP groups or MAC groups as in the SG. The MAC groups appear to be missing. 
 Generally the principle of the objects like in the SG is missing. 
 Is that correct and why is that so ??? 
 
 Greeting

FormerMember · Answer

Hi NoName NoName2 , 
 Thank you for reaching out to the Community! 
 Go to Hosts and services > MAC host to configure a single MAC host or a list of MAC host entries. Check out the following document for more info: 
 
 Add a MAC host 
 
 Thanks,

LuCar Toni · Answer

You can use LAN to WAN and work user based on XG. This will completely replace the need of any MAC or IP in your firewall rule set. I saw many customers completely adapting this principle and only using zones + user based access. 
 XG supports multiple authentication mechanism to leverage the use case of mapping a user (actual person) to a computer. This replaces the need of MAC or IP. 
 For example: i have intercept X installed on all clients in my network. The intercept X client sends the user information via sync user id to the XG firewall. After my initial sign-in to the windows client, XG knows my user and my groups. I can use this information in my network rules by simply tell the firewall: My domain administrator can use SSH to my servers. This is one rule, which do not need anything like MAC or IP. The server zone is a segmented area in my network (VLAN), which points to XG. My Admin will login to the client and can open Putty SSH to any server in my server segment. 
 Server segment is rather stateless. You can use authentication there, but most customer still use IPs in server segments because they need the IPs. But the question is, how big is your server segment (anymore)? Then you have the DHCP server system. Most customers in bigger networks rely on a DHCP server, which supports pooling etc. So they use DHCP relay and foward the requests to the service, taking over DHCP and reporting etc. 
 Segmentation is still a big open issue in server networks. There are customers, still running one segment with terminal servers, exchange, internal databases in one segment, which is a big security risk. by splitting up this segment into different segments, you can again work with zone based networking.

Definde Objects/groups

Top Replies