Panorama Pre rule reuse with firewall type but different inside zones

[Johndbabio1]

I want to reuse a pre ruleset because all firewalls of a type get these firewall rules. The issue is the inside interfaces are different zone names. Whats the best way to handle that situation while using the "no any zone" best practice? I am alreadly overriding an object-group to specify these zones networks. We cannot override the zones of a policy rule unfortunately.

[Mick_Ball]

I'm not sure if i read you correctly but I just clone the policy, change the zone information as required  and only have the intended firewall ticked in the target window.

[Johndbabio1]

Hi MickBall, I thought about that too but when a rule changes across the board you now have to update that change across your fleet. That is hard to do if you all your rules sets are technically now separate. 😞

[Johndbabio1]

I wish there was a way to override the zones. 😕

[Johndbabio1]

There only place that is consistent for the zones are using the outside interface as a reference point. That isn't using Palo Alto best practice of using "no any" for zone.

[Mick_Ball · Accepted solution]

if you think that's likely to happen often then you may be best to add all the same zones to all the firewalls, you don't have to have them used anywhere, just exist. then you can have one policy for all and sleep most of the day....   

[Johndbabio1]

Yea, that was my next guess. I will have to pick out the most common amongst all the firewalls and add them. Thanks!