XML Config from Panorama managed device, where are the policies?

[Chacko42]

Hi community,

scenario: When provisioning a standalone firewall with panorama and performing a config-sync to a non-panorama-managed passive HA peer, there are not policies etc.

After exporting the xml config from the active peer, I noticed, that the xml does not contain any policy rulesets and objects.

Now I wonder:
What happens if panorama is not available and a firewall reboots?

Where are the policies stored? Do they survive a reboot when no panorama config is available?

Is there a way to sync a panorama pushed-config to a passive-peer when creating a cluster?

As you guys know, sometimes you cannot just push the config from panorama to the secondary passive peer, because a few dependencies get messy (DG does not work, because of no zone, Template push does not work because zone-protection log-forwarding profile is in the DG config)

Any hints are appreciated

Best Regards

Chacko

[LukeBullimore · Accepted solution]

Hey @Chacko42

You won't see Panorama pushed policies in the firewalls XML running configuration correct. However, you will see it in the device state (you can export it from GUI).

If the Panorama becomes unavailable and Panorama reboots, or if the firewall becomes disconnected from the Panorama - the policies will still remain so no worries about that.