Panorama-shared objects

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

Panorama-shared objects

L4 Transporter

I am just setting up a panorama with 25 managed firewalls.

How can I have shared objects that are only shared between few firewalls but not all? My perimneter firewalls have huge number of objects which I would not like sharing with other remote firewalls but to some datacenter firewalls. how can I achieve this?

 

Thanks.

2 REPLIES 2

Cyber Elite
Cyber Elite

@SThatipelly,

Take a look at this document https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/manage-device-groups/...

 

Panorama has the option to disable the Share Unused Address and Service Objects with Devices (which is enabled by default) so that you're only sharing objects if it's actually needed in the configuration. 

Hi @SThatipelly ,

In addition to what @BPry explained I would also suggest to organize your device group in hierarchical structure

Something like this:

Shared

-- Perimeter-FWs

---- Perimeter-FW-01

---- Perimeter-FW-02

---- Perimeter-FW-03

-- DataCenter-FWs

---- DataCenter-FW-01

---- DataCenter-FW-02

---- DataCenter-FW-03

 

 

- Everything defined in "Shared" device group will be inherited by all device groups. This is build-in device-group which always sits on top.

- Everything defined in "Perimeter-FWs" will be inherited only by device groups that are children of this group

- Everything defined in "DataCenter-FWs" will be inherited only by device groups that are children of this group

 

Probably better explanation could be found here - https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/panorama-overview/centralized-firewal...

  • 1728 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!