Manage the Rule Hierarchy

1. View the rule hierarchy for each rulebase.

   1. Select the Policies tab and click Preview Rules.
   2. Filter the preview by Rulebase (for example, Security or QoS).
   3. Filter the preview to display the rules of a specific Device Group and the rules it inherits from the Shared location and ancestor device groups. You must select a device group that has firewalls assigned to it.
   4. Filter the preview by Device to display its locally defined rules.
   5. Click the green arrow icon to apply your filter selections to the preview (see Device Group Policies).
   6. Close the Combined Rules Preview dialog when you finish previewing rules.
2. Delete or disable rules, if necessary.

   To determine which rules a firewall doesn’t currently use, select that firewall in the Context drop-down on Panorama, select the rulebase (for example, PoliciesSecurity), and select the Highlight Unused Rules check box. A dotted orange background indicates the rules that the firewall doesn’t use.

   1. Select the rulebase (for example, PoliciesSecurityPre Rules) that contains the rule you will delete or disable.
   2. Select the Device Group that contains the rule.
   3. Select the rule, and click Delete or Disable as desired. Disabled rules appear in italicized font.
3. Reposition rules within a rulebase, if necessary.

   To reposition local rules on a firewall, access its web interface by selecting that firewall in the Context drop-down before performing this step.

   1. Select the rulebase (for example, PoliciesSecurityPre Rules) that contains the rule you will move.
   2. Select the Device Group that contains the rule.
   3. Select the rule, select Move, and select:

      • Move Top—Moves the rule above all other rules in the device group (but not above rules inherited from Shared or ancestor device groups).
      • Move Up—Moves the rule above the one that precedes it (but not above rules inherited from Shared or ancestor device groups).
      • Move Down—Moves the rule below the one that follows it.
      • Move Bottom—Moves the rule below all other rules.
      • Move to other device group—See Move or Clone a Policy Rule or Object to a Different Device Group.
4. If you modified the rules, commit and push the changes.

   1. Select CommitCommit and Push and Edit Selections in the Push Scope
   2. Select Device Groups, select the device group that contains the rules you changed or deleted, and click OK.
   3. Commit and Push your changes to the Panorama configuration and to device groups.