©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
85
Manage
Firewalls
Manage
Device
Groups
Manage
Device
Groups
Add
a
Device
Group
After
you
add
the
firewalls,
you
can
group
them
into
device
groups
(up
to
256).
A
device
group
can
include
one
or
more
firewalls
or
virtual
systems
that
need
similar
policies
and
objects
and
can
therefore
be
effectively
managed
as
a
logical
unit.
When
managing
firewalls
that
are
configured
in
an
active
‐
passive
high
availability
(HA)
configuration,
make
sure
to
place
both
firewalls
in
the
same
device
group
in
Panorama.
This
is
essential
to
make
sure
that
the
same
policies
and
objects
are
pushed
to
both
firewalls
in
the
HA
pair.
Panorama
pushed
policies
are
not
synchronized
between
firewall
HA
peers.
Add
a
Device
Group
Step
1
Create
Device
Group(s).
A
device
can
belong
to
only
one
Device
Group;
for
devices
with
multiple
virtual
systems,
each
virtual
system
can
belong
to
a
different
Device
Group.
1.
Select
Panorama > Device Groups
,
and
click
Add
.
2.
Enter
a
unique
Name
and
a
Description
to
identify
the
device
group.
3.
Use
the
filters
to
select
the
devices
that
you
would
like
to
add
to
the
group.
4.
(Optional)
Select
the
Group HA Peers
check
box
for
firewalls
that
are
set
up
as
an
HA
pair.
Adding
both
firewalls
or
virtual
systems
to
the
same
device
group
allows
you
to
push
shared
policies
and
objects
simultaneously
to
both
peers.
To
group
HA
peers,
the
firewalls
must
be
running
PAN
‐
OS
5.0
or
later.
5.
Assign
a
Master
device
for
the
device
group,
if
you
plan
to
use
users
or
groups
in
policy.
The
master
device
is
the
firewall
(and
only
device
in
the
Device
Group)
from
which
Panorama
gathers
username
and
user
group
information
for
policy
evaluation.
6.
Click
OK.
7.
Click
Commit
,
and
select
Panorama
as
the
Commit Type
.
Save
the
changes
to
the
running
configuration
on
Panorama.
8.
Click
Commit
,
and
select
Device Group
as
the
Commit Type
.
Push
the
changes
to
the
devices
in
the
device
group.
