Device Group Policies
Table of Contents
Device Group Policies
Device groups provide a way to implement a layered approach
for managing policies across a network of managed firewalls. A firewall evaluates
policy rules by layer (shared, device group, and local) and by type
(pre-rules, post-rules, and default rules) in the following order
from top to bottom. When the firewall receives traffic, it performs
the action defined in the first evaluated rule that matches the
traffic and disregards all subsequent rules. To change the evaluation
order for rules within a particular layer, type, and rulebase (for example,
shared Security pre-rules), see Manage
the Rule Hierarchy.
Whether you view rules on a firewall or
in Panorama, the web interface displays them in evaluation order.
All the shared, device group, and default rules that the firewall
inherits from Panorama are shaded orange. Local firewall rules display
between the pre-rules and post-rules.
Evaluation Order | Rule Scope and Description | Administration Device |
|---|---|---|
Shared pre-rules | Panorama pushes shared pre-rules to
all the firewalls in all device groups. Panorama pushes device group-specific
pre-rules to all the firewalls in a particular device group and
its descendant device groups. If a firewall inherits rules
from device groups at multiple levels in the device group hierarchy,
it evaluates pre-rules in the order of highest to lowest level.
This means the firewall first evaluates shared rules and last evaluates
the rules of device groups with no descendants. You can use
pre-rules to enforce the acceptable use policy of an organization.
For example, a pre-rule might block access to specific URL categories
or allow Domain Name System (DNS) traffic for all users. | These rules are visible on
firewalls but you can only manage them in Panorama. |
Device group pre-rules | ||
Local firewall rules | Local rules are specific to a single firewall
or virtual system (vsys). | A local firewall administrator, or a Panorama
administrator who switches to a local firewall context, can edit
local firewall rules. |
Device group post-rules | Panorama pushes shared post-rules to
all the firewalls in all device groups. Panorama pushes device group-specific
post-rules to all the firewalls in a particular device group and
its descendant device groups. If a firewall inherits rules
from device groups at multiple levels in the device group hierarchy,
it evaluates post-rules in the order of lowest to highest level.
This means the firewall first evaluates the rules of device groups
with no descendants and last evaluates shared rules. Post-rules
typically include rules to deny access to traffic based on the App-ID™
signatures, User-ID™ information (users or user groups), or service. | These rules are visible on
firewalls but you can only manage them in Panorama. |
Shared post-rules | ||
intrazone-default interzone-default | The default rules apply only to the Security
rulebase, and are predefined on Panorama (at the Shared level) and
the firewall (in each vsys). These rules specify how PAN-OS handles
traffic that doesn’t match any other rule. The intrazone-default
rule allows all traffic within a zone. The interzone-default rule
denies all traffic between zones. If you override default
rules, their order of precedence runs from the lowest context to
the highest: overridden settings at the firewall level take precedence
over settings at the device group level, which take precedence over
settings at the Shared level. | Default rules are initially read-only, either
because they are part of the predefined configuration or because Panorama
pushed them to firewalls. However, you can override the rule settings
for tags, action, logging, and security profiles. The context determines
the level at which you can override the rules:
|