topic Major flaw in Panorama: can't configure anything without a real firewall added! in General Topics

Major flaw in Panorama: can't configure anything without a real firewall added!

fjwcash — Wed, 10 Apr 2019 22:41:52 GMT

1. Create a Template. Add some network interfaces and zones and related stuff to it.

2. Create a Device Group. Add some Address Objects to it, that you'll be referenceing in your Security/NAT Policies later.

3. Try to create a Security/NAT Policy ... and notice how none of your Zones are available!

There's nothing in Panorama that links Templates with Devices Groups (except for the physical firewall / managed device), which makes it pretty much useless for pre-planning and pre-configuring things before your actual firewalls arrive.

What's even worse, is that if you have actual firewalls assigned to your Devices Groups and Templates, and you remove the last firewall from a Device Group (or Template), you will never be able to commit any changes from that point onward if you have used anything from the Network tab in the Policy tab. You get nothing but "invalid references". You basically have to clear out the Policy tab completely whenever you remove the last device from a Device Group. You can't keep an empty group around for future use!

There *really* needs to be a way to link Device Groups and Templates without requiring an actual, in production physical firewall. One should not need to wait until the hardware is there to start preparing the config for it. This means I can't use the next 3 months to pre-configure things before we get the firewall for a new school in July, and will instead have to rush through everything in August. Here I thought Panorama was supposed to make my life easier. 😞

So, how is one supposed to write Security Policies (part of Device Group) without having access to Zones (required entry) from a Template? I just spent the day configuring everything under Device tab, Network tab, and Objects tab, only to discover it was wasted time as I can't use any of that stuff under the Policies tab as I don't have any managed devices yet to link them together!

Tested with Panorama 7.1, 8.1, and 9.0.

Re: Major flaw in Panorama: can't configure anything without a real firewall added!

LukeBullimore — Fri, 12 Apr 2019 12:43:18 GMT

Hey @fjwcash

I was able to reproduce the same behaviour as you, and find a fix!

1. Go to Panorama -> Managed Devices -> Summary

2. Add a new serial number (it doesn't even have to be a valid one just spam some numbers)

3. Associate your fake FW to the device group and template

4. Commit to Panorama

You can now reference your zones in the policy.

Cheers,

Luke.

Re: Major flaw in Panorama: can't configure anything without a real firewall added!

fjwcash — Fri, 12 Apr 2019 15:21:42 GMT

Huh, didn't even think to try faking a serial number. It's not pretty, but it does "work".

I'll have to play around with that to see how to match things up between the two groups (Templates/Devices Groups) to get inheritance working properly.

Thanks for the hint!

Re: Major flaw in Panorama: can't configure anything without a real firewall added!

Remo — Fri, 12 Apr 2019 18:45:07 GMT

Even if you cannot choose the zones, you can still enter the names manually. The names will only be choosable when - as you noticed - a device is added to the devicegroup/template. The same "problem" occurs when you create policies in a parent device group where the devices are attached to child devicegroups. There you have to enter the names manually but it works as it should and the policies of the parent device groups arw also applied to the devices in the child device groups.

Re: Major flaw in Panorama: can't configure anything without a real firewal

chmotley — Fri, 11 Sep 2020 00:09:48 GMT

To update this thread, in 8.1/9.0 and later code versions, there are now mechanisms called Reference Templates (See step 4) in each Device Group (DG) where you can specify templates to be used in the DG config. This ensures Zones, server profiles, etc, are usable in DG config.

Re: Major flaw in Panorama: can't configure anything without a real firewal

fjwcash — Fri, 11 Sep 2020 18:38:33 GMT

There is no Reference Template section in Panorama 8.1.15-h3. whether creating a new Device Group, or editing an existing one.