PAN-OS · MANAGER

PAN-OS-style: one policy, two firewalls, two templates

Two branches share a policy but not addresses. So they share one device group, and each has its own template. Shared holds what every device group gets. Change one rule on the manager, push once, and both firewalls have it.

Palo Alto PAN-OS-style track · Palo Alto PAN-OS-style, Cisco router, Buddy Policy Manager · 4 objectives

Open in simulator More Palo Alto PAN-OS-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

Template T1 for F1 (192.168.1.1/24 and 203.0.113.1/24, default route to 203.0.113.2), and template T2 for F2 (192.168.2.1/24 and 198.51.100.1/24, default route to 198.51.100.2).
Device group BRANCHES with both firewalls in it: a NAT rule HIDE from trust to untrust behind ethernet1/2, and a pre-rule OUT allowing trust to untrust.
In shared, a pre-rule NO-P2P: deny bittorrent from any to any. Commit, push both templates, then push the device group.
PC1 and PC2 reach 192.0.2.1. From PC2: traffic tcp 192.0.2.1 6881 payload "BitTorrent protocol" is denied by the shared rule.

Start this lab

Before you start

Both firewalls use the same zone names and ethernet1/2, which is why one policy fits both. Shared rules go on top of a group’s pre-rules, and at the bottom of its post-rules.

Concept

A template holds the network, a device group holds the policy

A manager runs many firewalls from one place. Templates hold network settings, device groups hold rules and objects, and shared holds what every group gets. There are two steps: commit saves on the manager, and push sends what is committed to the firewalls. A firewall that refuses a push keeps what it had.

Concept

Pre-rules, local rules, post-rules

A firewall reads pushed rules around its own. Pre-rules come first, so a site can’t get around them. Local rules come next. Post-rules come last, as a catch-all. Then the two defaults apply.