An object or Policy created in Palo-Alto needs to appear in Panorama.

[mohammedsalhis]

Dear Team ,

The customer requested that in addition to being able to create an object or policy in Panorama and push it to the Palo Alto Firewall, he should also be able to create an object on the firewall itself, which is managed by Palo Alto Firewall, and that it should be replicated in Panorama.

Is there an option need to be enabled to create an object or policy in PA that will be shared in Panorama? It is requested that when you create object in PA, it should synchronize with Panorama and vice versa.

Thank you, team, 

[PavelK]

Hello @mohammedsalhis

thanks for post.

There is no native/built-in way to synchronize an object or policy from a Firewall to Panorama. Even if you over come this with scripting to automate an object creation in Firewall and in Panorama's Device Group at the same time, it is going to have following side effect. After an object is created in Panorama, the Device Group will become out of sync. To resolve the configuration out of sync issue, you will have to push that configuration to Firewall, however you will get an error while pushing configuration as an identical object already exists in Firewall locally.

To me the requirement from your customer is not practical. Would you be able to give more context what your customer would like to accomplish?

Kind Regards

Pavel