I have a policy rule imported from a Juniper with one Vsys.
I'd like to split the rules and migrate them in different Device Group (Multiple VSYS) in a Panorama
It seems that Expedition only give the possibilty to export the rules in one Device group in the Mapping tab. So if rules belong to multiple device, the only solution i ve found is to move the security policies to one Device group and then to move them with Panorama console in the other Device groups.
Is there a trick to get more granularity in the Device group Export?
Thanks for your help
If the security policy is shared by all device group, you can moved them to shared in Expedition. If they are not shared, you could try export the merged config from Expedition and perform "load config partial" in Panorama CLI to load the security policy to the corresponding device groups https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-cli-quick-start/use-the-cli/load-configurations/...
use the below move rules function in Panorama GUI to move rules from one device group to another device group https://docs.paloaltonetworks.com/panorama/9-0/panorama-admin/manage-firewalls/manage-device-groups/...
Hope this helps!
There is a function in export tab if you are converting from multi-vsys or multiple firewalls to multiple device groups, where you can drag and drop the left side's security policy from different vsys to the corresponding device groups on the right side and merge the config. But In your scenario , you are converting from single vsys to multiple device groups, so you won't be able to drag and drop the security policy to different device groups. Please see attached screenshot:
Yes i agree, but there is no way to clone the rules from one device group to another in Expedition.
And when it is dragged to the right, left content gets empty. So no real solution in my scenario. Panorama GUI is the way to go
You are right. We have an option to move a rule to Shared, but we did not implement a feature to move/clone a rule between different DGs/VSys.
We will take note of this need and add it to our list of functionalities we would like to provide in Expedition 2.0, which it is currently under development.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!