The universally unique identifier (UUID) for
a rule is a 32-character string (based on data such as the network
address and the timestamp of creation) that the firewall or Panorama
assigns to the rule. The UUID uses the format 8-4-4-4-12 (where
8, 4, and 12 represent the number of unique characters separated
by hyphens). UUIDs identify rules for all policy rulebases. You
can also use UUIDs to identify applicable rules in the following
log types: Traffic, Threat, URL Filtering, WildFire Submission,
Data Filtering, GTP, SCTP, Tunnel Inspection, Configuration, and
Unified.
Using the UUID to search for a rule enables you
to locate a specific rule you want to find among thousands of rules
that may have similar or identical names. UUIDs also simplify automation
and integration for rules in third-party systems (such as ticketing
or orchestration) that do not support names.
In some cases,
you may need to generate new UUIDs for existing rulebases. For example,
if you want to export a configuration to another firewall, you need
to
regenerate the UUIDs for the rules as you import
the configuration to ensure there are no duplicate UUIDs. If you
regenerate UUIDs, you are no longer able to track those rules using their
previous UUIDs and the hit data and app usage data for those rules
are reset.
The firewall or Panorama assigns UUIDs when you:
Create new rules
Clone existing rules
Override the default security rules
Load a named configuration and regenerate UUIDs
Load a named configuration containing new rules that are
not in the running configuration
Upgrade the firewall or Panorama to a PAN-OS 9.0 release
When
you load a configuration that contains rules with UUIDs, the firewall
considers rules to be the same if the rule name, rulebase, and virtual
system all match. Panorama considers rules to be the same if the
rule name, rulebase, and the device group all match.
Keep
in mind the following important points for UUIDs:
If
you manage firewall policy from Panorama, UUIDs are generated on
Panorama and therefore must be pushed from Panorama. If you do not
push the configuration from Panorama prior to upgrading the firewalls
to PAN-OS 9.0, the firewall upgrade will not succeed because it
will not have the UUIDs.
In addition, if you are upgrading an HA pair, upon upgrade
to PAN-OS 9.0, each peer independently assigns UUIDs for each policy
rule. Because of this, the peers will show as out of sync until
you sync the configuration ().
If you remove an existing high availability (HA) configuration
after upgrading to PAN-OS 9.0, you must regenerate the UUIDs on
one of the peers () and commit the changes
to prevent UUID duplication.
All rules pushed from Panorama will share the same UUID;
all rules local to a firewall will have different UUIDs. If you
create a rule locally on the firewall after you push the rules from
Panorama to the firewalls, the rule you created locally has its
own UUID.
To replace an RMA Panorama, make sure you Retain
Rule UUIDs when you load the named Panorama configuration
snapshot. If you do not select this option, Panorama removes all
previous rule UUIDs from the configuration snapshot and assigns
new UUIDs to the rules on Panorama, which means it does not retain information
associated with the previous UUIDs, such as the policy rule hit
count.