topic Re: Panorama Shared Policy Zones in General Topics

Panorama Shared Policy Zones

IgorZhukovsky — Tue, 04 Sep 2018 01:42:50 GMT

Hi all,

I want to understand before I deploy shared policy in Prod

I have 2*2 firewalls in HA (2 For DMZ, 2 For LAN) - I want to create a shared policy to both firewalls (LAN and DMZ)

For example,

In LAN I have 3 zones (Users, Servers, DMZ)

In DMZ I Have also 3 zones (LAN, DMZ Servers, Internet)

when I want to create one policy to shared device-group from Servers to the Internet

I create a rule with source zone Servers and Dest zone Internet

What the panorama Push to each ( because in LAN FW the Internet Zone not exists) and DMZ FW does not exist Server zone ...

Re: Panorama Shared Policy Zones

reaper — Tue, 04 Sep 2018 12:12:04 GMT

you will need 2 policies, one for each set of firewalls, as the internal ones do not understand what 'internet' means, they need a policy to the zone that eventually leads to the internet

panorama will push _exactly_ what you create (and the firewalls need to be able to interpret what they receive from panorama)

Re: Panorama Shared Policy Zones

IgorZhukovsky — Tue, 04 Sep 2018 13:01:20 GMT

internet it is the "Internet zone" on the DMZ FW