What is an Address Group?

An address group is a reusable Versa policy object that combines IP subnets, ranges, wildcard addresses, FQDNs, address objects, or other address groups under one name. Referencing the group – instead of every address it contains – lets a single security, SD-WAN, or QoS policy match many addresses at once.

Key takeaways

• Address groups combine addresses so one policy can match them all.
• Members can be subnets, ranges, wildcards, FQDNs, or other groups.
• Static groups list explicit members; dynamic groups match by tag.
• One organization can define an unlimited number of address groups.
• Security, SD-WAN, and QoS policies all accept address groups as criteria.

On this page: Why it matters · How it works · Types · Address Groups & Versa · FAQ

Why are address groups important?

Security, SD-WAN, and QoS policies all match traffic on source and destination address. Without grouping, an administrator applying one access decision to a set of related hosts – a subnet of servers, a list of partner IP ranges, a fleet of cloud workloads – has to add every address to every rule that needs it, and repeat the edit in each rule when the set changes.

An address group collapses that list into one named object a rule references once. Add or remove a member, and every policy referencing the group updates automatically, instead of requiring a pass through each rule. Dynamic address groups extend the benefit to addresses not stable at configuration time: a cloud workload under live migration keeps its policy coverage as its IP changes, because the group is matched by tag rather than a fixed value.

What is an address group?

An address group is a named container that groups website addresses, address objects, address files, and other address groups into a single reusable match value. Rather than referencing an address object – one IP subnet, range, wildcard mask, or FQDN – a policy references the group, which can hold up to six address types and, without an uploaded address file, tens of thousands of values per type.

Address groups are configured under Objects & Connectors in Versa Director, or Reusable Objects in Concerto’s Tenant view, then selected as source or destination match criteria in stateful firewall, NGFW, Application QoS, policy-based forwarding, and SD-WAN traffic-steering policies. A group can also be created inline while building a policy rule. Because a group can itself contain other groups, administrators can build layered groupings – a regional group made up of several site-level groups, for example.

Types of address groups

Versa distinguishes two address-group types. A static address group lists its members explicitly: address objects, uploaded address files, IP subnets, ranges, wildcard masks, IPv6 subnets, or other address groups, in any mix up to six types per group. This is the default – the type used for stable infrastructure such as server subnets, partner IP ranges, or branch LANs.

A dynamic address group matches members by tag instead of a fixed value, built for addresses that change – cloud workloads tagged through a CMS connector, or hosts mapped through an uploaded IP-subnet-to-tag file. Match terms combine tags with AND/OR logic, so membership updates as tagged resources come and go. Concerto’s Tenant-view workflow frames the same choice as Static IP Address versus Address Feed, the latter pulling membership from an external feed.

Address Groups & Versa

Address groups are one of several reusable objects Versa provides so a configuration is built once and referenced everywhere it applies – alongside address objects, services, schedules, and logging profiles. Director tracks every reference to a group, so an administrator can see which templates and devices use it before editing or deleting it; Concerto’s Reusable Objects view adds View Audit Log and Copy to Subtenant actions for the same objects.

Address groups commonly attach to common (datastore) templates, so a group defined once can be referenced by every service template in a tenant that needs it – keeping a shared policy, say a list of blocked partner subnets, consistent across a tenant’s firewall and SD-WAN configurations. Director’s Monitor tab also reports address-group membership directly, under Networking > Address Groups. See Configure Address Objects for the full field reference.

Frequently asked questions

What’s the difference between an address object and an address group?

An address object is a single match value – one IP subnet, range, wildcard mask, or FQDN. An address group combines multiple address objects, address files, or other address groups into one named object, so a policy can match all of them by referencing the group once.

What’s the difference between a static and a dynamic address group?

A static address group lists its members explicitly – subnets, ranges, FQDNs, address objects. A dynamic address group matches members by tag, typically for cloud workloads whose IP addresses change; membership updates automatically as tagged resources appear or disappear, without editing the group.

Can an address group contain other address groups?

Yes. Static address groups can nest other address groups alongside address objects, subnets, ranges, and FQDNs, letting administrators build layered groupings – for example, combining several site-level groups into one regional group that a single policy rule can then reference directly.

Which policies can match on an address group?

Address groups are valid source or destination match criteria in stateful firewall and NGFW security policies, Application QoS, policy-based forwarding, and SD-WAN traffic-steering policies – anywhere a policy rule needs to match traffic by source or destination address rather than by a single IP value.

Is there a limit on how many address groups an organization can have?

No – Versa Director places no limit on the number of address groups per organization. Limits instead apply within a group: up to six address types, and up to 32,767 entries per type before an uploaded address file is required.

More on address groups

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about address groups, these are worth looking at next.