11-09-2017 10:01 AM
Here's a couple of options:
1.) run all of your Panorama rules as "post-rules". Then if your Panorama instance is unavailable, you can login to the firewall directly and add a rule above the Panorama rules.
2.) Keep your Panorama rule-base as pre-rules and acquire a redundant Panorama configured in high-availability. This reduces the possibility that Panorama is ever unavailable in the first place.
Of course there's the nuclear option where you sever completely from Panorama and import all of the objects/policies into the local configuration - but that will likely cause quite a bit of work to put it back under the control of Panorama.
