@cmr wrote: @Brian_Scheele they are org wide, there is only Organization - Policy Objects. I think the use is more aimed at say access to central servers where multiple networks are traffic to servers x,y and z is allowed, with policy objects you can define the server group once and re-use. Are you managing multiple ASAs on different sites through one console? Yes and No. I use ASDM, which just has multiple saved connections to multiple ASAs, or SSH, but never to more than one ASA at a time, and there is no central repository of objects. If they have/had a central object repository, it would make life nice, sort of like what Meraki is doing with Policy Objects. It seems like they missed an opportunity here, but it is still helpful. From what everyone has responded, it seems like I can make it work, but I would just need to be careful not to accidentally give some random vendor, service, etc. access to multiple sites. If Users can talk to Printers in one network, then it is quite likely then can talk to printers in any network, and a group object of Printers covering multiple sites is fine. If a vendor needs access to something in Management, then I get more granular, not just grant access to Management itself, but instead to the exact resources needed. The more I think of it, this probably a good way to go the way it is designed. Create my objects, assign them to groups, apply rules, policies, etc. - whatever Meraki has enabled so far - to those groups. Not much different than with an ASA...
... View more
