Value Override Per Device

Cisco Security Manager contains an object management feature called value override per device. Value override allows the same object name to have different values or contents for different devices. For example, say that the user wants to have a common security policy to allow HTTP from all inside networks to all destinations. A single network object with the entire list of inside networks could be a very large object. A more attractive and more secure approach would be to have a single security policy with a source object named "inside networks" and then have the contents of "inside networks" be a variable that contains only the inside networks that are protected by each device. The per-device object override features allow a single access control list (ACLs) rule with a network object to be defined for multiple devices, but with the contents or value of the network object, such as the "inside network" example, to be defined uniquely for each device. A display of the value override per device check box is displayed in Figure 9-25.

Figure 9-25. Value Override Per Device