Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature]: Object-Groups #56

Open
cyberndj opened this issue Aug 10, 2022 · 5 comments
Open

[Feature]: Object-Groups #56

cyberndj opened this issue Aug 10, 2022 · 5 comments
Labels

Comments

@cyberndj
Copy link

NetBox version

v3.2.7

Feature type

Add a function

Proposed functionality

Include the ability to use object-groups for use in ACLs

Use case

Have a Menu Section like "ACL Object Groups." Different types would be "network" or "service" object groups. The object groups would be a list of IP networks/hosts and service object groups would have ports/protocols.

In the ACLs, you can reference an object group in the rule entry.
Example:
object-group network Private-Nets
192.168.0.0 255.255.0.0
172.16.0.0/12
10.0.0.0 255.0.0.0
169.254.0.0/16

ACL:
permit ip object-group Private-Nets any
deny ip any any log

External dependencies

No response

@cyberndj cyberndj added the enhancement New feature or request label Aug 10, 2022
@ryanmerolle
Copy link
Collaborator

Sorry for the delay here.

It feels like this is more of a firewall type of function. I guess Cisco IOS allows for this.

My only point is, should I make this be a more generalized plugin to expand to be security policies and model something like nautobot plugin firewall models?

@cyberndj
Copy link
Author

Admittingly, my examples are Cisco specific and the features do seem firewall-ish (groupings are a firewall (L4+) feature). I would point out a lot of modern routers do let you add items to ACEs for header fields (ie Cisco's established (permit ip any any established)) ...and my knowledge is 90% cisco, 2% Ubiquiti, 8% others... so my other manufactures knowledge is very slim on how they do things.

The nautobot plugin looks cool and could be what configuring a firewall policy could be like with all the extra fields that a FW would need. ...but I think something general/simple like using base NetBox prefix/IPs groups and maybe NetBox Services to do the protocol/port groupings.

@fansari
Copy link

fansari commented Feb 3, 2023

From my opinion everything which helps do build switch ACLs would be useful because this is our usecase.

For hosts we don't need ACLs because you can build firewall rules with "Services" in Netbox.

@cs-1
Copy link
Contributor

cs-1 commented Apr 3, 2024

This feature would be great. Aruba CX also supports object groups under AOS CX.

@ctsalidis
Copy link

Hi @ryanmerolle , hi community,

Is there any conclusion yet, whether this feature is going to be supported in Netbox? Is there any schedule for the release?

Thank you in advance!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

5 participants