https://live.paloaltonetworks.com/t5/vm-series-in-the-private-cloud/vcenter-plugin-notify-groups-inherited-address-objects-and/m-p/507484#M59 <P>In working with the panorama vcenter plugin, I've noticed unexpected results when panorama uses inherited ancestor address group objects when trying to pull vcenter tag matches.&nbsp; &nbsp;<BR /><BR />It appears if the object is in the local device group, panorama populates dynamic tags, address objects into the group, and everything works.</P><P>&nbsp;</P><P>When using inherited address groups (notify group is mapped to descendant), panorama will no longer populate the dynamic tags from vcenter, nor will it show the actual addresses.&nbsp; &nbsp;However, the firewalls still receive the mappings normally, and updates as expected.&nbsp; It makes it impossible to search/match when the address group is at a higher level, but if you get the matches right (manually type the vcenter path), it appears to populate the firewalls as expected.</P><P>&nbsp;</P><P>Wondering if there is some mapping on the backend of panorama that isn't populating, or if the plugin is expecting everything to be at a single device group level?<BR />Any feedback/experiences with this?</P> Thu, 30 Jun 2022 18:08:21 GMT Sec101 2022-06-30T18:08:21Z https://live.paloaltonetworks.com/t5/vm-series-in-the-private-cloud/vcenter-plugin-notify-groups-inherited-address-objects-and/m-p/507484#M59 <P>In working with the panorama vcenter plugin, I've noticed unexpected results when panorama uses inherited ancestor address group objects when trying to pull vcenter tag matches.&nbsp; &nbsp;<BR /><BR />It appears if the object is in the local device group, panorama populates dynamic tags, address objects into the group, and everything works.</P><P>&nbsp;</P><P>When using inherited address groups (notify group is mapped to descendant), panorama will no longer populate the dynamic tags from vcenter, nor will it show the actual addresses.&nbsp; &nbsp;However, the firewalls still receive the mappings normally, and updates as expected.&nbsp; It makes it impossible to search/match when the address group is at a higher level, but if you get the matches right (manually type the vcenter path), it appears to populate the firewalls as expected.</P><P>&nbsp;</P><P>Wondering if there is some mapping on the backend of panorama that isn't populating, or if the plugin is expecting everything to be at a single device group level?<BR />Any feedback/experiences with this?</P> Thu, 30 Jun 2022 18:08:21 GMT https://live.paloaltonetworks.com/t5/vm-series-in-the-private-cloud/vcenter-plugin-notify-groups-inherited-address-objects-and/m-p/507484#M59 Sec101 2022-06-30T18:08:21Z