add vsys in firewall , Panorama will show new vsys

[Martin_Chung]

A pair of firewall managed by Panorama.

I only use the device group in Panorama.

If I add a new vsys ( i.e. vsys2 )  in firewall , Panorama will show the new vsys ? 

[SutareMayur]

@Martin_Chung,

First, only thing that you should look is, Is your gateway supports multi vsys ? Multi vsys are supported on 3200 series and on wards models. You need license to enable multi vsys on 3200 series models.

And Yes if you add new vsys on the Panorama and push configuration on the gateway, new vsys will be visible on the Panorama under desired template where you have created the vsys as well as on the gateways. Once vsys is created, you can take required interface under new vsys and also have separate DG. Now you didn't mention anything about templates. How are you managing the templates?

[Martin_Chung]

Thanks for your reply.

i do not use the template from panorama to create the vsys. is it possible ?

my template only have some sylog server setting  and authentication setting.

For network part( like interface , routing ,.. ) , i will configure on the firewall ( not panorama ) .

For panorama, i use the device group to deploy the security policy ,NAT, object,...)

when i add new vsys on firewall ( not panorama ), how Panorama work for this newly created vsys ?

[TomYoung]

Hi @Martin_Chung ,

You cannot create a new vsys from Panorama.  It needs to be created on the NGFW.  Edit:  I got this from an old document!  You can create a vsys on Panorama!  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLsWCAW

Template settings have a vsys option.

The vsys should show up as a separate device for device groups.  I am not sure if it will populate automatically in the list when you create it.  That allows you to push a separate set of rules to the new vsys.

Please create the new vsys locally and let me know if you can see it in the list of devices under Panorama > Device Groups.

Thanks,

Tom