topic Re: How to add local rules above panorama managed rules, above the pre-rules if Panorama is down in General Topics

How to add local rules above panorama managed rules, above the pre-rules if Panorama is down

tstores31 — Thu, 09 Nov 2017 15:07:02 GMT

My question would be if Panorama is unavailable and we need to apply a new local rule on a firewall(to block something), how can we create this new local rule and move it above the Panorama managed Pre-Rules? Correct me I am wrong, but any new local rules will be applied below all Pre-Rules and above the Post-Rules.

Re: How to add local rules above panorama managed rules, above the pre-rules if Panorama is down

Mick_Ball — Thu, 09 Nov 2017 17:01:16 GMT

good point... I would imagine you would need to go device\setup\panarama settings and disable policy and objects, you will get the option to copy the policies to the local device, then add the required policy and when up and running stick it back on paranormal.

what a nightmare... hopefully there is another option....

Re: How to add local rules above panorama managed rules, above the pre-rules if Panorama is down

jvalentine — Thu, 09 Nov 2017 18:01:24 GMT

Here's a couple of options:

1.) run all of your Panorama rules as "post-rules". Then if your Panorama instance is unavailable, you can login to the firewall directly and add a rule above the Panorama rules.

2.) Keep your Panorama rule-base as pre-rules and acquire a redundant Panorama configured in high-availability. This reduces the possibility that Panorama is ever unavailable in the first place.

Of course there's the nuclear option where you sever completely from Panorama and import all of the objects/policies into the local configuration - but that will likely cause quite a bit of work to put it back under the control of Panorama.