topic Panorama Pre rule reuse with firewall type but different inside zones in General Topics

Panorama Pre rule reuse with firewall type but different inside zones

Johndbabio1 — Fri, 26 Mar 2021 17:00:32 GMT

I want to reuse a pre ruleset because all firewalls of a type get these firewall rules. The issue is the inside interfaces are different zone names. Whats the best way to handle that situation while using the "no any zone" best practice? I am alreadly overriding an object-group to specify these zones networks. We cannot override the zones of a policy rule unfortunately.

Re: Panorama Pre rule reuse with firewall type but different inside zones

Mick_Ball — Fri, 26 Mar 2021 17:10:01 GMT

I'm not sure if i read you correctly but I just clone the policy, change the zone information as required and only have the intended firewall ticked in the target window.

Re: Panorama Pre rule reuse with firewall type but different inside zones

Johndbabio1 — Fri, 26 Mar 2021 17:16:08 GMT

Hi MickBall, I thought about that too but when a rule changes across the board you now have to update that change across your fleet. That is hard to do if you all your rules sets are technically now separate. 😞

Re: Panorama Pre rule reuse with firewall type but different inside zones

Johndbabio1 — Fri, 26 Mar 2021 17:17:04 GMT

I wish there was a way to override the zones. 😕

Re: Panorama Pre rule reuse with firewall type but different inside zones

Johndbabio1 — Fri, 26 Mar 2021 17:20:28 GMT

There only place that is consistent for the zones are using the outside interface as a reference point. That isn't using Palo Alto best practice of using "no any" for zone.

Re: Panorama Pre rule reuse with firewall type but different inside zones

Mick_Ball — Fri, 26 Mar 2021 17:24:01 GMT

if you think that's likely to happen often then you may be best to add all the same zones to all the firewalls, you don't have to have them used anywhere, just exist. then you can have one policy for all and sleep most of the day....

Re: Panorama Pre rule reuse with firewall type but different inside zones

Johndbabio1 — Fri, 26 Mar 2021 17:27:52 GMT

Yea, that was my next guess. I will have to pick out the most common amongst all the firewalls and add them. Thanks!