topic Re: Panorama not show rules shadow in General Topics

Panorama not show rules shadow

Alpalo — Mon, 29 Nov 2021 11:54:36 GMT

Hello,

I have several devices managed from Panorama. All in version 9.1.7 .

When I commit from the team it shows the rules shadow warnings but when I do the same from the panorama it is not shown.

Does anyone know the reason for this?

Is it possible to see the shading rules from panorama?

Regards

Re: Panorama not show rules shadow

PavelK — Tue, 30 Nov 2021 00:06:02 GMT

Thank you for posting question @Alpalo

I believe the reason why you are not seeing a shadow rule warning while committing Panorama configuration is the fact that you are committing rules that are being pushed by Panorama and within those rules you do not have any shadow rules, however while committing local Firewall configuration you are seeing shadow rules that were locally configured. Since, Panorama does not own and manage locally configured rules, you will not see that warning from Panorama.

I can't think of a way to get that view of shadow rules from Panorama other than going to: Device Group > Security > Preview Rules > Rule Base: Security, then select Device Group and Device, then you will get a view of all the rules (pushed by Panorama and local). You can refer to rule usage, to see rules that are not getting hit.

An alternative, could be a 3rd party tool for example Firemon to detect redundant/unnecessary rules, but this is far off the topic.

Kind Regards

Pavel

Re: Panorama not show rules shadow

Alpalo — Thu, 02 Dec 2021 15:27:47 GMT

All rules are being transferred from Panorama and loaded in FW in volatile. In local, with some exception there are no rules at all.

Any idea?

Thanks so much

Re: Panorama not show rules shadow

PavelK — Thu, 02 Dec 2021 22:06:00 GMT

Thank you for reply @Alpalo

Do you mean you imported local Firewall configuration into Panorama and pushed it back to Firewall from Device Group?

Kind Regards

Pavel

Re: Panorama not show rules shadow

Alpalo — Fri, 03 Dec 2021 08:00:30 GMT

No, the configuration is pushed from the panorama.