Multi Vsys query.

djohnson229 — Mon, 04 Aug 2025 07:24:34 GMT

When managing a multi-vsys firewall, is the correct way to map each vsys to a unique Device Group? Lets say I have vsys_prod and vsys_dev, I would do:

Device Group "prod_device_group" mapped to "vsys_prod"

Device Group "dev_device_group" mapped to "vsys_dev"

The reason for my confusion. I can see that Panorama allows me to add multiple vsys's to the same Device Group, but when I do this there is no way to add Objects or Policies to a specific vsys (there is no option to select a vsys).

Any pointers would be really appreciated.

Re: Multi Vsys query.

JayGolf — Wed, 06 Aug 2025 01:31:28 GMT

Hi @djohnson229 ,

From Panorama's perspective, any security policy or object in a Device Group applies equally to all firewalls. There is no mechanism to target a specific firewall/vsys within a Device Group. So a 1 vsys:1 device group allows you to have clear isolation between prod and dev.

If youd like to segment based on environment type, your setup could like like the following as you add more vsys/fws:

Shared
PROD(Device Group for shared PROD policies)
vsys_prod_NY_DG (for site-specific policies)
vsys_prod_VA_DG (for site-specific policies)

DEV

vsys_dev_NY_DG

vsys_dev_VA_DG

topic Multi Vsys query. in General Topics

Multi Vsys query.

Re: Multi Vsys query.