topic Re: Can I migrate policy rules from pre-rules to post-rules category and push to Firewalls without causing downtime? in Panorama Discussions

Can I migrate policy rules from pre-rules to post-rules category and push to Firewalls without causing downtime?

fbarnard — Thu, 18 May 2023 00:27:17 GMT

So, I am new to palo-alto and I created some pretty general policies for internal-to-dmz communication, I now wanted to create a policy that would target specific host-to-destinations for testing, however, I noticed that the primary "Allow All" policy was set in the pre-rules, which takes precedence in the hierarchy. (Top to bottom). So what I need to do is migrate my "Allow All" policy to the Post-rules section so that my test policy can be hit before the first rule comes in play.

SO, now that's out of the way, my real question is; If I apply these changes in Panorama then push to my firewalls, will there be a loss in connection, sessions etc when the policy is moved down in the hierarchy?
I did a test from one of my sandbox environments, looked like there was no hiccup with ping, but ping is no stateful connection if you know what I mean ;).

Re: Can I migrate policy rules from pre-rules to post-rules category and push to Firewalls without causing downtime?

TomYoung — Fri, 19 May 2023 13:22:09 GMT

Hi @fbarnard ,

I have moved rules between pre- and post- many times with no down time. HOWEVER, with that said there is always a chance of an outage when you change the order or rules. Verify the new order of rules is good, and you should be fine.

Thanks,

Tom

Edit: I just moved my outbound rule to the Internet from each device group to Shared. I was doing an outbound ping, and I dropped one packet.

Re: Can I migrate policy rules from pre-rules to post-rules category and push to Firewalls without causing downtime?

fbarnard — Thu, 18 May 2023 16:10:21 GMT

Thank you for the confirmation! Yes, I am keeping in mind the rules currently set, we are still in the phase of policy control setup, right now we are testing the communication between zones. I just wanted to make sure I was putting my more broad policy in the right hierarchy before implementing more stringent or specific policy.