How to add local rules above panorama managed rules, above the pre-rules if Panorama is down

[tstores31]

My question would be if Panorama is unavailable and we need to apply a new local rule on a firewall(to block something), how can we create this new local rule and move it above the Panorama managed Pre-Rules? Correct me I am wrong, but any new local rules will be applied below all Pre-Rules and above the Post-Rules.

[Mick_Ball]

good point... I would imagine you would need to go device\setup\panarama settings and disable policy and objects, you will get the option to copy the policies to the local device, then add the required policy and when up and running stick it back on paranormal.

what a nightmare... hopefully there is another option....

[jvalentine]

Here's a couple of options:

1.) run all of your Panorama rules as "post-rules".  Then if your Panorama instance is unavailable, you can login to the firewall directly and add a rule above the Panorama rules.  

2.) Keep your Panorama rule-base as pre-rules and acquire a redundant Panorama configured in high-availability.  This reduces the possibility that Panorama is ever unavailable in the first place.

Of course there's the nuclear option where you sever completely from Panorama and import all of the objects/policies into the local configuration - but that will likely cause quite a bit of work to put it back under the control of Panorama.