Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Variable Zones for Group Policies Overview

A variable zone is a reusable zone reference that maps to a device-specific zone during policy deployment. For each device, the variable is replaced with its mapped zone. If no mapping exists, a configured default zone is used.

Figure 1 shows an example of how variable zones map to actual device zones.

Figure 1: Variable Zones Mapping Variable Zones Mapping

You have a group security policy named FW-G1 with two devices, Dev-1 and Dev-2. Each device uses a distinct zone—Dev-1 is assigned Z1, while Dev-2 is assigned Z2—but their other settings are identical.

Instead of creating separate security policy rules for each device, use a variable zone in a single policy rule.

  1. Define Z3 as the default variable zone.

  2. Map Z3 to the actual zones on each device: Z1 for Dev‑1 and Z2 for Dev‑2.

  3. Apply Z3 in the security policy rule for FW‑G1.

When the FW‑G1 security policy takes effect, Juniper Security Director automatically replaces Z3 with the appropriate zones—Z1 and Z2—for each device. This approach enables you to maintain a single policy rule instead of managing multiple rules for each device.

To access this page, click Security > Shared Objects > Variable Zones.

Field Descriptions

Table 1: Fields on the Variable Zones Page

Field

Description

Name

The name of the variable zone.

Default Value

The fallback zone value for the variable zone when a device has no explicit zone mapping.

Zone Mapping

The mapping of variable zones to actual zones configured in devices to inherit their policies. If no mapping exists, the default zone is selected.

Description

The description for the variable zone.

Benefits of Variable Zones

Variable zones provide a flexible, scalable way to abstract zone definitions across devices, enabling consistent policy configuration in dynamic environments.

  • Create a single policy that works across multiple devices, even when the devices use different zones, removing the need to duplicate or rewrite policies.

  • Onboard new devices by updating their zone mappings only, without changing existing policies, making it easier to grow and adapt deployments.

  • Use per-member mappings in MNHA clusters to ensure accurate, reliable policy enforcement on each cluster member.

  • Find and manage variable zones quickly through Global Search, improving day-to-day operational efficiency.

  • Easy to adopt and use variable zones by leveraging variable addresses workflow.