©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
13
Panorama
Overview
Centralized
Configuration
and
Deployment
Management
Device
Groups
To
use
Panorama
effectively,
you
must
group
the
firewalls
on
your
network
into
logical
units
called
device
groups.
A
device
group
allows
grouping
based
on
network
segmentation,
geographic
location,
or
by
the
need
to
implement
similar
policy
configurations.
A
device
group
can
include
physical
firewalls,
virtual
firewalls
and/or
a
virtual
system.
By
default,
all
managed
devices
belong
to
the
Shared
device
group
on
Panorama.
Device
Groups
enable
central
management
of
policies
and
objects
using
the
Policies
and
Objects
tabs
on
Panorama.
Objects
are
configuration
elements
that
are
referenced
in
policies.
Some
of
the
objects
that
firewall
policies
make
use
of
are:
IP
addresses,
URL
categories,
security
profiles,
users,
services,
and
applications.
Using
Device
Groups
you
can
create
shared
objects
or
device
group
‐
specific
objects
and
then
use
these
objects
to
create
a
hierarchy
of
rules
(and
rulebases)
to
enforce
how
managed
firewalls
handle
inbound
and
outbound
traffic.
For
example,
a
corporate
acceptable
use
policy
could
be
defined
as
a
set
of
shared
policies.
Then,
to
allow
only
the
regional
offices
to
access
peer
‐
to
‐
peer
traffic
such
as
BitTorrent,
you
can
create
a
security
rule
as
a
shared
policy
and
target
it
to
the
regional
offices
or
make
it
a
device
group
rule
that
is
pushed
to
the
regional
offices.
See
Policies
Device
groups
provide
a
way
to
implement
a
layered
approach
for
managing
policies
across
a
network
of
managed
firewalls.
The
following
table
lists
the
policy
layers,
the
firewalls
to
which
the
policies
apply,
and
the
platform
where
you
administer
the
policies:
Both
shared
policies
and
device
group
‐
specific
policies
allow
you
to
craft
pre
‐
rules
and
post
‐
rules
to
centrally
manage
all
the
rulebases:
Security,
NAT,
QoS,
Policy
Based
Forwarding,
Decryption,
Application
Override,
Captive
Portal,
and
DoS
Protection.
Pre
‐
rules
—Rules
you
add
to
the
top
of
the
rule
order
and
that
PAN
‐
OS
evaluates
first.
You
can
use
pre
‐
rules
to
enforce
the
Acceptable
Use
Policy
for
an
organization;
for
example,
to
block
access
to
specific
URL
categories,
or
to
allow
DNS
traffic
for
all
users.
Pre
‐
rules
can
be
shared
or
device
group
‐
specific.
Post
‐
rules
—Rules
that
PAN
‐
OS
evaluates
after
the
pre
‐
rules
and
the
local
firewall
rules.
Post
‐
rules
typically
include
rules
to
deny
access
to
traffic
based
on
the
App
‐
ID,
User
‐
ID,
or
Service.
Like
pre
‐
rules,
post
rules
can
be
shared
or
device
group
‐
specific.
Policy
Scope
Administration
Platform
Shared
All
the
firewalls
in
all
device
groups.
Panorama
Device
group
‐
specific
All
the
firewalls
assigned
to
a
single
device
group.
Panorama
Local
(firewall
‐
specific)
A
single
firewall.
Firewall
Default
(security
rules
only)
By
default,
the
default
rules
are
shared
(apply
to
all
firewalls
in
all
device
groups)
and
are
part
of
the
predefined
configuration.
However,
if
you
edit
(override)
the
rules,
their
scope
changes
to
the
level
at
which
you
performed
the
edits:
device
group
or
local
(firewall/virtual
system).
Panorama
or
Firewall
