A global organization uses Panorama to manage hundreds of Palo Alto Networks firewalls across various regions. A new security policy needs to be deployed to all firewalls in a specific region, but the policy must also include some region-specific objects (e.g., address groups, custom applications) that are unique to that region. How should the administrator configure Panorama to efficiently push this policy while incorporating the unique regional objects?
- AUse Templates to define the region-specific objects and apply them to the firewalls, then deploy a shared policy from the Panorama root.
- BCreate a new Device Group for the region, define the shared policy and region-specific objects within that Device Group, and then push.
- CDefine all policies and objects at the Panorama root (Shared) and rely on firewall override settings for regional differences.
- DCreate a shared policy rule in the Device Group hierarchy and manually add region-specific objects to each firewall.
Show answer & explanationAnswer & explanation
Correct answer: B. Create a new Device Group for the region, define the shared policy and region-specific objects within that Device Group, and then push.
Creating a dedicated Device Group for the region allows the administrator to define a common security policy for that group and also include region-specific objects (address groups, custom applications) directly within that Device Group. This ensures that the policy and its relevant objects are pushed simultaneously to all firewalls in that region, leveraging Panorama's hierarchical management.
Why the other options are wrong
- A. Templates are primarily for device-specific configurations (interfaces, zones, routing), not for policy rules and objects that vary by region.
- C. Defining everything at the root and relying on overrides is complex and error-prone for managing regional policy variations efficiently.
- D. Manually adding objects to each firewall defeats the purpose of centralized management and is inefficient for hundreds of firewalls.
Panorama Device Groups
A hierarchical structure in Panorama used to organize firewalls and apply common security policies and objects to groups of firewalls.
- Organizes firewalls logically
- Applies policies and objects hierarchically
- Enables shared and device-specific configurations
- Supports inheritance from parent groups
Memory trick: Panorama manages a forest of firewalls, with policies flowing from the canopy to specific branches.