There are three primary ways of assigning policies (
NATPolicy objects) to devices:
- Directly via the
assigned_devicesattribute on a policy object.
- Dynamically by assigning an existing
DynamicGroupobject to the
assigned_dynamic_groupsfield on a policy object.
- By creating a new
Relationshipspecifying additional targets for policy association. This can be, for example, used to associate a policy with an
- The use of a Relationship may limit future integrations with parsing or templating.
Although policies can be created without any rules it is recommended to create the required underlying objects first before moving to the policy definitions. Creation Order provides an ordered list of steps for creating and assigning, objects, needed for policy creation.