Meraki External Dynamic IP list

[CDTC]

Hello, 

I have a list of IP addresses that is maintained by our External Security team. Currently I'm running the API to take this list of IP addresses and add it to a Policy Object group which is included in our Layer 3 firewalls. This list has grown to over 150 IP addresses now and has hit the limit of the PolicyGroup. 

Is there a better "Dynamic" approach to blocking these IP addresses? 

Thank you!

[cmr]

As a policy object can be an FQDN, perhaps you could create one and have multiple IP addresses behind it.  If you then add the FQDN to the group that might allow more than the 150 limit.  I must admit that I haven't tried it, but if you add one of the existing IPs to an FQDN along with the next you want to add, you will soon see if it works!

[PhilipDAth]

Rather than adding the IP addresses all the time to the firewall, why not add the dynamic FQDN DNS name of the MX once?

https://documentation.meraki.com/MX/Other_Topics/Dynamic_DNS_(DDNS)

Because it would be so easy to manage, you could create two groups.

[CDTC]

As needing to block incoming connections to the firewall from a list of all "bad" IP addresses, Using a FQDN wouldn't work. As I understand how it works, it resolved a FQDN and then blocks the IP that it resolved to. 

I'm working on adding a clause to my API script to create a new group and then search for the rules that use the existing block lists.  

[cmr]

@CDTC an FQDN can resolve to multiple IP addresses, as long as it doesn't care about the reverse DNS, it *might* work...