Policy creation/management

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Policy creation/management

L0 Member

Hi Folks,


We have a running sites where firewall running and managing through panorama. clients building a new sites and new firewall deployments however panorama will be remain same and policy will be the same just few sub-nets needs to be changed. there are many policy in exiting firewalls/panorama. Is there any way to copy existing policy into new policy group? or we have do to create them manually?




Cyber Elite
Cyber Elite

Hello @sachin_chauhan


thank you for the post.


If you mean copying policies between different device groups, then you can do a bulk cloning of policies by selecting multiple policies and placing copy to different device group:




Slightly different approach would be leveraging device tags in policies. With device tags associated with certain sites you can manage what policies are pushed to different sites. This will however require a bit of planning.



Kind Regards


Help the community: Like helpful comments and mark solutions.

Cyber Elite
Cyber Elite

Hi @sachin_chauhan ,


Using tags by @PavelK is the easiest solution with just a few different subnets.  If you don't want to use tags, you can also manually check the device under the Target tab in the policy rule.


Another solution is to use nested device groups.  Put the policies that don't change in the higher device group and the policies that are different for different NGFWs in a lower device group.  You can use the Move button on the bottom of the GUI to do this.  I generally put all objects in Shared.  This method makes it easier to manage multiple NGFWs but requires planning.


Once done, you can clone your lower device group.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cla3CAC  Or you can copy the rules as @PavelK suggested.  Assign the new NGFW to the new DG and make the changes needed.


These are other options for you.





Help the community: Like helpful comments and mark solutions.
  • 2 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!