©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
15
Panorama
Overview
Centralized
Configuration
and
Deployment
Management
For
details
on
rule
management,
refer
to
the
Objects
Objects
are
configuration
elements
that
are
referenced
in
policies.
Some
of
the
objects
that
firewall
policies
make
use
of
are:
IP
addresses,
URL
categories,
security
profiles,
users,
services,
and
applications.
Because
objects
can
be
reused
across
policies,
creating
shared
objects
or
device
group
objects
reduces
duplication
of
these
configuration
elements.
For
example,
creating
shared
address
objects
and
address
groups
or
shared
service
objects
and
service
groups
allows
you
to
create
one
instance
of
the
object
and
reference
it
in
any
rulebase
to
manage
the
firewalls
across
multiple
device
groups.
Because
shared
objects
are
defined
once
but
used
many
times,
they
reduce
administrative
overhead,
and
maintain
consistency
and
accuracy
everywhere
the
shared
object
is
used.
Pre
‐
rules,
post
‐
rules
and
rules
locally
defined
on
a
firewall
can
all
use
shared
objects
and
device
group
objects.
When
creating
an
object
on
Panorama,
configure
the
behavior
based
on
whether:
The
device
group
object
takes
precedence
over
a
shared
object,
when
both
objects
have
the
same
name.
By
default,
the
Shared
Object
Takes
Precedence
option
is
disabled
on
Panorama.
This
behavior
ensures
that
a
shared
object
only
supersedes
a
device
group
object
with
the
same
name
if
you
explicitly
want
the
value
of
a
shared
object
to
prevail.
When
you
enable
the
option
for
shared
objects
to
take
precedence,
Panorama
informs
you
of
all
the
device
group
objects
that
will
be
shadowed.
However,
if
a
device
has
a
locally
created
object
with
the
same
name
as
a
shared
or
a
device
group
object
that
is
pushed
from
Panorama,
a
commit
failure
will
occur.
All
shared
and
device
group
objects
that
are
defined
on
Panorama
are
pushed
to
the
managed
devices.
By
default,
all
objects—those
that
are
and
are
not
referenced
in
policies—are
pushed
to
the
managed
devices.
