- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
11-09-2017 07:07 AM
My question would be if Panorama is unavailable and we need to apply a new local rule on a firewall(to block something), how can we create this new local rule and move it above the Panorama managed Pre-Rules? Correct me I am wrong, but any new local rules will be applied below all Pre-Rules and above the Post-Rules.
11-09-2017 09:01 AM
good point... I would imagine you would need to go device\setup\panarama settings and disable policy and objects, you will get the option to copy the policies to the local device, then add the required policy and when up and running stick it back on paranormal.
what a nightmare... hopefully there is another option....
11-09-2017 10:01 AM
Here's a couple of options:
1.) run all of your Panorama rules as "post-rules". Then if your Panorama instance is unavailable, you can login to the firewall directly and add a rule above the Panorama rules.
2.) Keep your Panorama rule-base as pre-rules and acquire a redundant Panorama configured in high-availability. This reduces the possibility that Panorama is ever unavailable in the first place.
Of course there's the nuclear option where you sever completely from Panorama and import all of the objects/policies into the local configuration - but that will likely cause quite a bit of work to put it back under the control of Panorama.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!