topic Re: Policy creation/management in General Topics

Policy creation/management

sachin_chauhan — Wed, 15 Feb 2023 08:12:43 GMT

Hi Folks,

We have a running sites where firewall running and managing through panorama. clients building a new sites and new firewall deployments however panorama will be remain same and policy will be the same just few sub-nets needs to be changed. there are many policy in exiting firewalls/panorama. Is there any way to copy existing policy into new policy group? or we have do to create them manually?

Thanks

Re: Policy creation/management

PavelK — Wed, 15 Feb 2023 08:41:53 GMT

Hello @sachin_chauhan

thank you for the post.

If you mean copying policies between different device groups, then you can do a bulk cloning of policies by selecting multiple policies and placing copy to different device group:

Slightly different approach would be leveraging device tags in policies. With device tags associated with certain sites you can manage what policies are pushed to different sites. This will however require a bit of planning.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNdxCAG

Kind Regards

Pavel

Re: Policy creation/management

TomYoung — Wed, 15 Feb 2023 10:58:30 GMT

Hi @sachin_chauhan ,

Using tags by @PavelK is the easiest solution with just a few different subnets. If you don't want to use tags, you can also manually check the device under the Target tab in the policy rule.

Another solution is to use nested device groups. Put the policies that don't change in the higher device group and the policies that are different for different NGFWs in a lower device group. You can use the Move button on the bottom of the GUI to do this. I generally put all objects in Shared. This method makes it easier to manage multiple NGFWs but requires planning.

Once done, you can clone your lower device group. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cla3CAC Or you can copy the rules as @PavelK suggested. Assign the new NGFW to the new DG and make the changes needed.

These are other options for you.

Thanks,

Tom