Inside Address Configuration
The inside address specification is used by the security analytics. It allows you to specify the "inside" of your network. Configure all ranges of addresses (from /32 to /0) that are used inside your network, including your public IPv4 or IPv6 address space and all reserved address space.
If you want to include multicast IP addresses in reporting and alerting, enter them also in the Inside Address Configuration section. more
The security analytics compare current network behavior to profiles of typical network behavior. Because the security analytics focus on what is happening inside your network, internal addresses are tracked individually in the internal security database. However, external addresses are by default tracked in blocks of /8 within the internal security database to conserve system resources.
The Inside Address specification provides for tracking hosts individually within the security profile. It has no effect on address tracking and reporting for Performance and Availability analytics.
All hosts seen or reported to the NetProfiler are tracked individually and stored in flow logs for real time and historical reporting, regardless of the inside address specification. The inside address specification affects only which hosts can be included in host groups and which hosts are tracked individually in the internal security database.
When you run an advanced traffic report based on "typical behavior" instead of "historical detail," the appliance operates the same using /8 address tracking as it does using individual address tracking, except that some statistics may show traffic volumes for ranges of addresses instead of individual addresses. It is possible, although not very likely, that you might even see a specification for a range of addresses appearing as an entry in the Top 20 table of statistics.
You might notice that a /8 address range overlaps or completely includes a range of addresses that you have specified to be tracked individually. However, the two are tracked and reported separately. None of your individually tracked traffic is included in the statistics for the /8 block, and vice versa. The /8 traffic includes only traffic that was in the /8 range but not specified for individual tracking.