A utility's field-operations network includes three subnets used by different crew types: overhead-line trucks, substation maintenance vans, and metering technicians. The security engineer wants every crew subnet to share one identical firewall policy permitting access to the work-order dispatch server, and wants to add or remove a crew subnet later without editing the policy itself. Which approach best achieves this in FortiOS 7.6?

In FortiOS, a firewall policy's source or destination address field can point at a single address object or at an address group, and the group is the layer of indirection built for exactly this use case: it is a named collection of address objects that a policy references once. When crew subnets change, a new maintenance van pool added, an old truck subnet retired, only the group's membership list is edited; the policy's fields, its match order, and its log configuration all stay untouched. Referencing each subnet directly as a separate entry inside the policy achieves the same initial match behavior but does not meet the actual requirement, because adding or removing a subnet still means editing the policy object itself, which is the maintenance burden the engineer wants to avoid. Duplicating the policy per subnet is worse: it multiplies the objects an auditor has to review and increases the chance one copy drifts out of sync with the others. Collapsing the three subnets into one oversized supernet address object is also the wrong move, because a supernet almost always covers address space outside the intended crew networks, silently widening who can reach the dispatch server. To verify a group is working as intended, an engineer can add a test subnet to the group and confirm matching traffic starts passing without touching the policy at all.