I am just setting up a panorama with 25 managed firewalls.
How can I have shared objects that are only shared between few firewalls but not all? My perimneter firewalls have huge number of objects which I would not like sharing with other remote firewalls but to some datacenter firewalls. how can I achieve this?
Take a look at this document https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/manage-device-groups/...
Panorama has the option to disable the Share Unused Address and Service Objects with Devices (which is enabled by default) so that you're only sharing objects if it's actually needed in the configuration.
Hi @SThatipelly ,
In addition to what @BPry explained I would also suggest to organize your device group in hierarchical structure
Something like this:
- Everything defined in "Shared" device group will be inherited by all device groups. This is build-in device-group which always sits on top.
- Everything defined in "Perimeter-FWs" will be inherited only by device groups that are children of this group
- Everything defined in "DataCenter-FWs" will be inherited only by device groups that are children of this group
Probably better explanation could be found here - https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/panorama-overview/centralized-firewal...
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!