How to add local rules above panorama managed rules, above the pre-rules if Panorama is down

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

How to add local rules above panorama managed rules, above the pre-rules if Panorama is down

L1 Bithead

My question would be if Panorama is unavailable and we need to apply a new local rule on a firewall(to block something), how can we create this new local rule and move it above the Panorama managed Pre-Rules? Correct me I am wrong, but any new local rules will be applied below all Pre-Rules and above the Post-Rules.

2 REPLIES 2

L7 Applicator

good point... I would imagine you would need to go device\setup\panarama settings and disable policy and objects, you will get the option to copy the policies to the local device, then add the required policy and when up and running stick it back on paranormal.

 

what a nightmare... hopefully there is another option....

L7 Applicator

Here's a couple of options:

 

1.) run all of your Panorama rules as "post-rules".  Then if your Panorama instance is unavailable, you can login to the firewall directly and add a rule above the Panorama rules.  

 

2.) Keep your Panorama rule-base as pre-rules and acquire a redundant Panorama configured in high-availability.  This reduces the possibility that Panorama is ever unavailable in the first place.

 

Of course there's the nuclear option where you sever completely from Panorama and import all of the objects/policies into the local configuration - but that will likely cause quite a bit of work to put it back under the control of Panorama.  

  • 3725 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!