topic Re: Limit Shared Objects in General Topics

Limit Shared Objects

rob_moore — Fri, 17 Feb 2012 02:51:44 GMT

I have 8 5060s that I manage with Panorama, I share objects between all of these devices. I want to add a new pair of devices to Panorama that are completely separate from the other 8 and I don't want the shared objects to be on the new pair. I also want to prevent admins of the new pair from creating shared objects that will become part of the original 8. Is this possible?

Thanks

Rob

Re: Limit Shared Objects

mschuricht — Fri, 17 Feb 2012 18:02:50 GMT

Create a device group for the new devices and when creating object do not check the "Shared" checkbox. This will keep the objects in the DG and not send them to the other devices. If you create a DG Admin Role and give access to only the new DG where the new boxes reside, then the admin will not be able to create shared objects.

Re: Limit Shared Objects

rob_moore — Fri, 17 Feb 2012 18:23:17 GMT

Thank you so much Mike for your quick response, the problem is that I already have the 8 devices (4 device groups) in Panorama which already have shared objects. I don't want those existing shared objects to be pushed to the new devices I want to add to and manage via Panorama.

The second part of your answer makes sense, admins who only have access to a single DG can't create shared objects so objects created on the new device will not be made available to the existing systems... Thanks for clearing that up for me.

I just wish there was a way to prevent a device from accessing shared objects.

Thanks again

Rob

Re: Limit Shared Objects

rob_moore — Fri, 17 Feb 2012 19:37:15 GMT

I think I found the answer to my own question, there is a disable shared config option when you add the Panorama IP to the new device. DOH!

Thanks

Rob

Re: Limit Shared Objects

rob_moore — Fri, 17 Feb 2012 22:53:40 GMT

I was wrong, I am logged in to Panorama as a user with access to only the new devices, shared objects are still available to be used for the devices in which I had disabled shared config.

Re: Limit Shared Objects

bpappas — Thu, 23 Feb 2012 02:38:05 GMT

@rob.moore:

the 'disable shared config' option disables the shared configuration that was pushed from Panorama to the target device.

-Benjamin

Re: Limit Shared Objects

jochristian — Wed, 07 Nov 2012 13:03:19 GMT

Hello,

We are having an similar issue. We have lot's of address-objects (over 3000) that is shared on a Panorama installation.

We have 4 different device-groups with 3 of them containing PA-5050's.

Our problem now is that we also need to manage some PA-200's for some small installations and the PA-200 only supports a maximum of 2500 address-objects.

Is there any workaround for this problem? The PA-200's are not in the same device-groups as the PA-5050's.

Why are all the address-objects pushed to the PA-200 even if they are NOT in use in any security rules.

Jo Christian

Re: Limit Shared Objects

asieber — Wed, 07 Nov 2012 13:46:19 GMT

Hi Christian,

I think what you (and I) need is introduced in PANOS 5.0:

Release Notes:

Share Unused Address and Service Objects with Devices – This feature allows Panorama

to share all shared objects and device group specific objects with managed devices. When

unchecked, Panorama policies are checked for references to address, address group,

service, and service group objects and any objects that are not referenced will not be

shared. This option will ensure that only necessary objects are being sent to managed

devices in order to reduce the total object count on the device. The option is checked by

default to remain backward compatible with the current functionality of pushing all

Panorama objects to managed devices.

-Alex

Re: Limit Shared Objects

jochristian — Wed, 07 Nov 2012 13:56:49 GMT

Yes you are correct. This is exactly what we need 🙂

The big question now is. Is version 5.0 fully backwards compatible with PanOS 4.1?

Upgrading to PanOS 5.0 is not an option for this installation.

Jo Christian

Re: Limit Shared Objects

mschuricht — Wed, 07 Nov 2012 16:39:33 GMT

Yes. Panorama is backward compatible with all supported PAN-OS versions running on FWs.

This means that 5.0 Panorama can manage 3.1, 4.0, 4.1, and 5.0 devices.

https://support.paloaltonetworks.com/index.php?option=com_content&task=view&id=14&Itemid=147

Re: Limit Shared Objects

mikand — Thu, 08 Nov 2012 04:04:07 GMT

That release note from PANOS 5.0 sounds really odd to me...

When you connect a PA device to Panorma you will not be able to configure it from its own web-gui, only from the Panorama (regarding security rules set by the Panorama).

This can also be seen in the CLI where "show config running" wont display any security rules or address objects. You must run "show config pushed" to see those.

Then how come Panorama will push any unused objects to the device when the device can only be configured from Panorama itself?

Im not saying that what the release note says would be wrong, but rather why wasnt this the default behaviour from the beginning?

To me shared objects are just objects that should be available for all device groups (like global objects, compared to private objects which are only available for a specific device or device group), handy when you have administrators that are only allowed to see/manage a particular device/device group or for that matter so you as admin wont need to setup the same address object multiple times when using Panorama.

But when Panorama will compile the ruleset and push it to a particular device I would expect that the default behaviour would be to only include the shared objects needed for this particular ruleset (and by that by design handle the case that different hardware models can only hold different amount of address objects and security rules).

Re: Limit Shared Objects

mschuricht — Thu, 08 Nov 2012 17:15:05 GMT

Panorama has always pushed all Shared and any Device Group objects to managed devices.

This functionality in 5.0 adds the capability to do what you expected as the default behavior above.

Re: Limit Shared Objects

essnet — Thu, 08 Nov 2012 17:20:48 GMT

With 5.0 , there is now an option to push only used objects.

I had troubles with the 2000 limits in the past on my PA-200 , my Panorama shared object base was 2200 objects large. I had to hunt unused objects to allow commits to happen.

5.0 now fixes that problem but you are scaring me with that news about local devices not being administrable from their GUI anymore .... Panorama is sooooo sloooooow at switching contexts.

Re: Limit Shared Objects

mschuricht — Thu, 08 Nov 2012 18:00:49 GMT

Nothing change with 5.0 with respect to the object administration on the device. We are confused by your concern with the following statement.

5.0 now fixes that problem but you are scaring me with that news about local devices not being administrable from their GUI anymore ....

Can you be more specific about the concern so we can address the issue?

Re: Limit Shared Objects

essnet — Thu, 08 Nov 2012 18:26:37 GMT

I was refering to Mikand statement:

"When you connect a PA device to Panorama you will not be able to configure it from its own web-gui, only from the Panorama (regarding security rules set by the Panorama).'

I understood it this way : since 5.0 you can't manage a device that is Panorama enabled from its own GUI, only from Panorama. It surprised me as I didn't read that anywhere yet.

Re: Limit Shared Objects

mschuricht — Thu, 08 Nov 2012 18:41:30 GMT

I believe he was referring to the fact the rules/objects that were pushed from Panorama are not editable on the device. This is the same model that was present prior to 5.0 and is not likely to change.

All local config can still be managed on a device.

Re: Limit Shared Objects

mikand — Thu, 08 Nov 2012 20:31:18 GMT

Yeah thats what I meant, sorry for the confusion 🙂

Re: Limit Shared Objects

junaid.khan — Thu, 15 Nov 2012 23:50:19 GMT

Ah I'was looking for the same. Hope this fixes our issue. However, I can't jump on 5.0 and upgrade our panorama cluster or the devices. We just moved from 4.0.11 to 4.1.7hfa2. I don't see 5.0 happening to us any time soon. I wish there was other alternative to this resolution other then manually converting shared objects to device group specific.

Thanks

Junaid

Re: Limit Shared Objects

jochristian — Fri, 16 Nov 2012 08:04:12 GMT

Hello,

We upgraded to Panorama 5.0 and that fixed our problem.

We are still running 4.1 on all the firewalls.

Jo Christian