Hello there,
I was wondering, does anyone know the Object override behaviour, but for nested tree-style objects?
Let me paint the picture:
I have three firewalls (FTD1_DMZ, FTD2_DMZ, FTD_Transport) two of them have DMZs "behind" them.
I would like to create an Network Object Group, that has the DMZ subnets in it, like this:
ALL_DMZ (<--Parent)
FTD1_DMZ-Subnets (<-- child)
FTD2_DMZ-Subnets (<-- child)
And I would like to use this ALL_DMZ object in the Base policy for all firewalls, to fastpath the connections.'
There is only one caveat though: I dont want to fastpath the connections to the local DMZs, I would rather Analyze them (as the default action of the Base policy).
My idea would be, to create an object override for the ALL_DMZ in the following manner:
ALL_DMZ
FTD1_DMZ-Subnets <-- override on FTD1 for a "fake" IP address (as nothing is not an option)
FTD2_DMZ-Subnets <-- override on FTD2 for a "fake" IP address (as nothing is not an option)
So, when the connection is evaulated is against the local policies, it will not match on FTD1 for the local subnets -> therefore will be analyzed.
But on FTD_Transport, it will be fastpathed.
(I know it does not makes sense with 3 firewalls, but in reality I have more.)
So, my question is, does the behaviour of Objec override changes when used in nested Object groups?
Thank you!
