Why use address objects (named IP definitions) instead of typing raw IPs in firewall rules?
Address objects are reusable, named references to IP addresses or networks. They reduce typos, make rules readable, and let you change one definition rather than dozens of rules when an address changes.
* Define the address once; every system references the same object. *
The four advantages:
| Advantage | Without objects | With objects |
|---|---|---|
| Typo reduction | Type 192.168.100.50 30 times |
Type Fileserver (resolved to 192.168.100.50 everywhere) |
| Readability | "Allow 192.168.100.50 → 10.0.0.10" |
"Allow Fileserver → DMZ_Webserver" |
| Maintainability | If file server moves, edit 30 rules | Edit one address object — all rules update |
| Reuse | Repeat the IP in NAT, FW rule, DHCP reservation, DNS, monitoring | Point all of them at the same object |
A specific example:
Address Object | IP | Used in
DMZ_Interface | 10.0.0.1/24 | Interface IP, default gateway for DMZ devices
DMZ_Webserver | 10.0.0.10 | DNAT target, FW allow rule, DNS static entry
Inside_Server | 192.168.100.1/24 | Interface IP, FW rules
The "self-documenting" benefit:
"Selbst ohne Blick auf das Schema wird jedem klar, dass das Interface 1/1 der DMZ-Zone angehört."
When you read a rule like:
Allow Inside_Staff → DMZ_Webserver tcp/80
…you immediately understand the intent. Compare with:
Allow 192.168.110.0/24 → 10.0.0.10 tcp/80
…where you have to mentally translate IPs to roles.
The cross-system extension:
Mature environments use a single source of truth for address objects (e.g., Infoblox IPAM, NetBox) and import them into firewalls, DNS, monitoring, and configuration management. Renaming a host in one place updates everything.
Tip: Always create address objects, even in practice work. The 30 seconds spent naming an object now saves hours of debugging when you re-read your config in 6 months.
Go deeper:
IP address management (Wikipedia) — IPAM is the mature, cross-system version of the same idea: one authoritative source of address/host definitions (Infoblox, NetBox) feeding firewalls, DNS and monitoring.