Multi Vsys query.

[djohnson229]

When managing a multi-vsys firewall, is the correct way to map each vsys to a unique Device Group? Lets say I have vsys_prod and vsys_dev, I would do:

Device Group "prod_device_group" mapped to "vsys_prod"

Device Group "dev_device_group" mapped to "vsys_dev"

The reason for my confusion. I can see that Panorama allows me to add multiple vsys's to the same Device Group, but when I do this there is no way to add Objects or Policies to a specific vsys (there is no option to select a vsys).

Any pointers would be really appreciated.

DJ

[JayGolf · Accepted solution]

Hi @djohnson229 ,

From Panorama's perspective, any security policy or object in a Device Group applies equally to all firewalls. There is no mechanism to target a specific firewall/vsys within a Device Group. So a 1 vsys:1 device group allows you to have clear isolation between prod and dev. 

If youd like to segment based on environment type, your setup could like like the following as you add more vsys/fws:

Shared
           PROD(Device Group for shared PROD policies)
                      vsys_prod_NY_DG (for site-specific policies)
                      vsys_prod_VA_DG (for site-specific policies)

           DEV

                     vsys_dev_NY_DG

                     vsys_dev_VA_DG