A variable is useful when similar rules can be applied across devices where only the zone or address might differ. Using variables instead of static values allows you to create fewer rules and use them more widely. You can achieve this by creating a variable address or a variable zone that you configure for all devices to which you are applying a group policy.
Group firewall policy FW-G1 has two devices, Dev-1 and Dev-2. Each device has its own unique address. Dev-1 has address A1. Dev-2 has address A2.
You want to apply the same rule to both devices, but you do not want to configure two rules with all the same criteria except for the address. It is more efficient to configure one rule with a variable default address and apply it to both devices.
You can achieve this by creating an address variable with a default address, A3, and making A3 common to Dev-1 and Dev-2 in your rule. When you configure default address A3, you map it to the real address of each device, A1 for Dev-1 and A2 for Dev-2.
When group firewall policy FW-G1 is applied, these mappings are used to replace the default address with the real address for each device.
Variables are only used in group policies. They are not applicable to device policies.