Chapter 7: Device Groups - Tavve zoneranger User Manual

Chapter 7: Device Groups

A device group is a named set of IP addresses, or address patterns, defined using the deviceGroup
command on the Ranger Gateway, or using the Ranger Gateway Viewer. Device groups are similar to
address patterns in that they provide a concise mechanism for referring to a collection of devices in
configuration rules. The advantage of device groups is that they can refer to an arbitrary collection of
devices with disjoint addresses, as opposed to address ranges and wild cards which can only refer to
contiguous IP address spaces. This is useful when you need to apply configuration settings to devices of
a particular type (e.g. routers), where it is unlikely that the addresses of these devices will happen to fall
within a contiguous range.
For example, consider the following network:
Figure 7-1. Device Group configuration
The managed network in the figure contains two routers (10.1.1.1, and 10.2.1.50), three servers
(10.1.1.22, 10.1.1.40, and 10.2.1.18), and one ZoneRanger (10.1.1.100). In order to facilitate different
configuration settings for different device types, we could define two device groups:
•
MyRouters: 10.1.1.1, 10.2.1.50
•
MyServers: 1 0.1.1.22, 10.1.1.40, 10.2.1.18
Device groups can be used to define rules associated with Proxy Access Control (see Chapter 14) and
Proxy Map (see Chapter 16) services on the Ranger Gateway. For example, one of the tables used in
Proxy Access Control consists of rules of the following form:
<src-address> <dest-address> <port-configuration>
The <src-address> and <dest-address> values in these rules can be specified in the form of
specific addresses, address patterns, or device groups. Using the MyRouters and MyServers device
groups defined above, and assuming we have three defined port configurations, unimaginatively named
portConfig-1
using the following rules:
•
*.*.*.* @MyRouters portConfig-1
•
*.*.*.* @MyServers portConfig-2
•
*.*.*.* 10.1.1.100 portConfig-3
ZoneRanger 5.5 User's Guide
, portConfig-2 , and portConfig-3 , we could configure Proxy Access Control
23