14
•
Panorama
6.1
Administrator’s
Guide
©
Palo
Alto
Networks,
Inc.
Centralized
Configuration
and
Deployment
Management
Panorama
Overview
The
pre
‐
rules
and
post
‐
rules
that
Panorama
pushes
are
visible
on
the
managed
firewalls
but
only
editable
in
Panorama.
The
local
firewall
administrator
or
a
Panorama
administrator
who
switches
to
a
local
firewall
context
can
edit
local
firewall
rules.
Default
policies
apply
only
to
the
Security
rulebase.
The
default
rule
interzone
‐
default
specifies
that
the
firewall
denies
all
interzone
(between
zones)
traffic
that
doesn’t
match
another
rule.
The
default
rule
intrazone
‐
default
specifies
that
the
firewall
allows
all
intrazone
(within
a
zone)
traffic
that
doesn’t
match
another
rule.
When
you
preview
rules
in
Panorama,
the
default
rules
appear
below
all
other
rules.
Initially
the
default
rules
are
read
‐
only,
either
because
they
are
part
of
the
predefined
configuration
settings
or
because
Panorama
pushed
them
to
devices.
However,
you
can
override
the
settings
for
tags,
action
(allow
or
deny),
logging,
and
security
profiles.
The
device
context
determines
the
level
at
which
you
can
edit
(override)
default
rules:
On
Panorama,
you
can
edit
default
rules
that
are
part
of
the
predefined
configuration.
You
can
edit
rules
in
a
device
group
or
shared
context.
On
the
firewall,
you
can
edit
default
rules
that
are
part
of
the
predefined
configuration,
or
pushed
from
a
Panorama
shared
or
device
group
context.
The
default
rules
can
be
virtual
system
(vsys)
specific.
The
order
of
precedence
for
default
rules
runs
from
the
lowest
context
to
the
highest:
settings
edited
at
the
firewall
level
override
settings
at
the
device
group
level,
which
override
settings
at
the
shared
level.
The
evaluation
order
(from
top
‐
first
to
bottom
‐
last)
of
all
rules
is:
When
traffic
matches
a
policy
rule,
the
defined
action
is
triggered
and
the
firewall
disregards
all
subsequent
policies.
This
ability
to
layer
policies
creates
a
hierarchy
of
rules
where
local
policies
are
between
the
pre
‐
and
post
‐
rules,
and
are
editable
by
switching
to
the
local
firewall
context,
or
by
accessing
the
firewall
locally.
The
firewall
web
interface
visually
demarcates
this
cascade
of
rules
for
each
device
group
(and
managed
firewall),
and
provides
the
ability
to
scan
through
a
large
numbers
of
rules.
