90
•
Panorama
6.1
Administrator’s
Guide
©
Palo
Alto
Networks,
Inc.
Manage
Device
Groups
Manage
Firewalls
Manage
the
Rule
Hierarchy
The
ordering
of
policy
rules
is
essential
for
securing
your
network.
The
firewall
evaluates
rules
from
top
to
bottom
in
the
order
they
appear
in
the
Policies
tab
of
the
web
interface.
The
firewall
matches
a
packet
against
the
first
rule
that
meets
the
defined
criteria
and
does
not
evaluate
subsequent
rules.
Therefore,
the
more
specific
rules
must
precede
more
generic
ones
to
enforce
the
most
specific
match.
Push
a
Policy
to
a
Subset
of
Firewalls
Step
1
Create
a
policy.
1.
Select
the
Device Group
for
which
you
want
to
define
policy.
2.
Select
the
Policies
tab,
and
select
the
rulebase
for
which
you
would
like
to
create
policy.
For
example,
define
a
pre
‐
rule
in
the
Security
policies
rulebase
that
permits
users
on
the
internal
network
to
access
the
servers
in
the
DMZ:
a.
Click
Add
in
Policies > Security > Pre-Rules
.
b.
Give
the
rule
a
descriptive
name
in
the
General
tab.
c.
In
the
Source
tab,
set
the
Source Zone
to
Trust
.
d.
In
the
Destination
tab,
set
the
Destination Zone
to
DMZ
.
e.
In
the
Service/ URL Category
tab,
set
the
Service
to
application-default
.
f.
In
the
Actions
tab,
set
the
Action
to
Allow
.
g.
Leave
all
the
other
options
at
the
default
values.
Step
2
Target
the
policy
to
include
or
exclude
a
subset
of
devices.
To
apply
the
policy
to
a
selected
set
of
devices.
1.
Select
the
Target
tab
in
the
Policy
Rule
window.
2.
Select
the
devices
on
which
you
would
like
the
rule
to
apply.
If
you
do
not
select
devices
to
target,
the
policy
is
added
to
all
of
the
(unchecked)
devices
in
the
device
group.
By
default,
although
the
check
box
for
the
virtual
systems
in
the
Device
Group
is
unchecked,
all
the
virtual
systems
will
inherit
the
rule
on
commit.
Select
the
check
box
for
one
or
more
virtual
systems
to
which
you
want
the
rule
to
apply.
3.
(Optional)
To
exclude
a
subset
of
devices
from
inheriting
the
policy
rule,
select
the
check
box
Install on all but specified
devices
.
If
you
select
Install on all but specified devices
and
do
not
select
any
device,
the
policy
is
added
to
none
of
the
devices
in
the
device
group.
4.
Click
OK
.
5.
Save
the
configuration
changes.
a.
Click
Commit
,
and
select
Panorama
as
the
Commit Type
to
save
the
changes
to
the
running
configuration
on
Panorama.
b.
Click
Commit
,
and
select
Device Group
as
the
Commit Type
to
push
the
changes
to
the
devices
selected
in
the
Device
Group.
