Support object overrides for network objects

[GeorgeVII]

Hello and thanks for having a look at my post.

As of now, Meraki does not support object overrides for network objects in the same way Cisco FMC does.

Network Objects in Meraki are centrally managed and shared across all networks in an organisation.

When a Network Object is modified, the change is reflected across all firewall rules that reference it.

There is no native override feature that allows you to customise a shared object per network or device like FMC does.

Will Meraki ever support the ability to define a shared object and then override its value on specific devices, allowing for device-specific customisation while maintaining centralised policy management?

Has anyone else ever thought that Meraki should provide the ability to override network objects?

How can we convince the devs to add this feature?

Thanks,

George

[RWelch]

Give your feedback (previously Make a Wish) lets the Meraki teams know what you would like changed with our product and how that would help you.  Give them the use case in which it would benefit you or your networks.

[GeorgeVII]

Thank you RWelch! I will do that 🙂

[PhilipDAth]

Personally, I hope they don't do this.

When I see an object, I would prefer it to be the same everywhere that I see it.  Otherwise, I'll have to keep checking for overrides.  🙂

[GeorgeVII]

Thanks for having a look at my post and taking the time to reply, Philip.

When overrides for network objects are not allowed, managing multiple locations becomes challenging. If all offices share the same Layer 3 firewall rules, but you need to allow traffic from each office’s subnet specifically, you can’t leverage a template. This means that every time a rule needs to be added to all firewalls for example, each firewall ruleset will need to be updated manually (or leveraging the API).

[PhilipDAth]

Did you know that template firewall rules allow you to reference VLANs (rather than subnets)?

And even specific IP addresses (using the last part of the four-part address) inside the VLAN?

This does require you to have nice, uniformly deployed networks.

>you need to allow traffic from each office’s subnet specifically,

Any chance of using a supernet to resolve this issue?

[GeorgeVII]

Thanks so much for your reply Philip.

I was aware that VLANs can be referenced, but I didn’t realize this feature could be applied within a template—especially not with the option to specify an IP address inside the VLAN.

So, are you saying that Meraki is intelligent enough to automatically select the appropriate VLAN based on the network’s VLAN configuration?

[PhilipDAth]

The name that you assign to the MX interface is the name that is used.