Greetings and sorry for my English.
I'm setting stateful firewall rules (ACLs/filters/whatever you call it) on several Juniper SRX3xx appliances running Junos 15.1X49. What I'm actually trying to accomplish is to minimize my future manual labor in case I need to reconfigure some of the rules. On Cisco ASA the answer is simple: use objects instead of actual IP addresses. In case you need to change some server's IP only the object representing it should be changed while all related rules are left intact.
Junos has address books (security address-book ...) which serve similar purpose except they aren't applicable (?!) to firewall rules (firewall ... filter ... term ...). It also has prefix lists (policy-options prefix-list ...) which theoretically can be used in firewall rules (firewall ... filter ... term ... from source-prefix-list ...). It's weird to have two sets of the objects representing same IPs, but I can live with that. However prefix lists seem to be much more than just some object definitions to use elsewhere. Or should I say not the object definitions that I need at all? The topic is sadly pretty unclear in Juniper documentation which in most other cases is excellent.
So my question is: How does the typical Junos admin organize his firewall rules? Should it be the rules with the explicit IP addresses and than you edit it for few hours when you need to change single address? Or is it okay to use prefix lists extensively in firewall rules? Or do I miss something maybe?