About GN_ROS

@reaper - Thanks for the info (and sorry for the late reply - i didn't get a notification)   Allow me to clarify the position we have : We essentially have 3 rulebases : RED - controlled by Admin group 1    BLUE - controlled by Admin group 2 PURPLE - shared control by both admin groups.   The firewalls are active-active for the PURPLE ruleset and then there is a distinct virtual router (with unique routing) on each firewall to suit the RED ruleset (on HA device 0) and the BLUE ruleset (on HA device 1) The device tree at the moment is              PURPLE             /            \    RED              BLUE   FW0                 FW1   In the text diagram above - FW0 is master for red device group and FW1 is master for blue - there is no option to set the purple master device (option is none). I am happy with using template stacks to achieve the differences needed for Network and Device settings.   So while i can move rules from RED and BLUE to PURPLE (with appropriate rule targets) - with the goal of removing RED and BLUE, this then creates one flat rulebase with shared control, we lose the RBAC control.   am i missing any other way to organise things?   as an aside - how does this scale well, as with 4 tiers available for device groups, there could be a significant number of devices all receiving user groups at the leafs, but if they are not merged up each branch to the core (i.e panorama) then there is always going to be crazy high numbers of duplicate entries. Why does panorama not also have the ability to set a master at each branch of the device tree? (as there are no devices attached to the branch level - the option is none rather than any child device names) Thanks ... View more

@reaper  Sorry for the late response.  The initial reasons are historic... and probably not valid now if designed fresh.   While it is an active-active pair, each has its own virtual router and needed specific rules per side.  I think most of what we wish to achieve can be accomplished with targets. i will accept your solution as the best.  Thanks for your help. ... View more

Hi folks, @reaper , thanks for the reply. Yes master device is set, however this may be the root of the issue. We use a device group structure like so   Prod_Firewalls   -> ActiveFW1_group       FW1a   ->ActiveFW2_group      FW1b   In ActiveFW1_group - FW1a is the master In ActiveFW2_group - FW1b is master In Prod_Firewalls - None is selected, as there is no option for the lower groups or FW's to be selected.   So, Panorama therefore sees the two as Master i suppose. We have 2 groups like this such that 2 sets of admins can operate the permissions model.    Do you have any advice on how to overcome the dual mastership for identity info?    ... View more

Thanks for the confirmation,   Yes login lifetime increase is not a recommended way round this. We want the users to be regularly checked, zero trust model.   The solution we are looking for (and pursuing through our SE) is a 5 min warning and option to re authenticate before the tunnel dies.  This means existing TCP sessions, like SSH sessions, etc. do not drop, assuming the user wants to keep the tunnel up. ... View more