Palo Alto - Security rules best practice for web filtering delegation

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Palo Alto - Security rules best practice for web filtering delegation

L1 Bithead



We deploy multiple PA-220 and configure them through a unified Panorama. 


The need is to provide local administrators with the ability to manage a part of the web filtering to do things like add/remove a website from the allow/blocklist URL category that has been defined locally.


The biggest challenge to us, is in the way Palo Alto handles object configuration from Panorama to the local device. 


Essentially when having a rule that filters web traffic with an URL filtering object that has been defined on the Device Group level, then afaik there is no way for the local administrator to temper with that object, in order to add / remove some URL categories in there for instance.


This is of course a major security benefit but it also comes at the cost of practicality in the particular case where delegation matters. 


So the way we handle this for now, is that we create a local rule on each PA-220, and since all our Panorama rules are POST it takes precedence over it. 

This way we can assign locally created URL categories to it, and give the local administrators the ability to add/block websites without the need of our intervention. 


The problem with this is that it breaks the point of having a Panorama for web traffic, which is a tremendous part of the network, AND most importantly whenever the client policy changes for instance to block a particular category that was previously allowed, we would need to change that category on every single device manually. 


I am curious what is the proper take on this and how should web-traffic be considered in regards to these delegation purposes.


Thank you,


Cyber Elite
Cyber Elite

Hello @f4lkon


have you looked into Access Domains feature in Panorama: Access Domains? With Access Domains you can customize to what Device Group an administrator has access to. If you combine it with custom role (Sample here ), you can set a granular RBAC for your administrators to let them make changes from Panorama instead of doing it locally. You as a main admin can still review and audit all changes centrally from Panorama.


Kind Regards


Help the community: Like helpful comments and mark solutions.



Indeed we are aware of this option, however it is not possible in our use case since the access to the remote network hosting the Panorama is not allowed from the branch sites. 

Consequently, local administrators are not enabled to interact with the Panorama as a result of this network restriction.


Thank you for your reply



  • 2 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!