Building security policies in Panorama
When building rule bases in Panorama, there is also a hierarchy that allows us to create rules in a parent group so that they apply to all children. You may recall from previous chapters that we could choose a parent device group in the mobile users and remote networks settings. Depending on the number of device groups and firewalls managed in Panorama, you can place all the device groups in Shared (or one level down, as I did in the following screenshot) by creating a parent device group called Prisma that contains all the Prisma access device groups:
Figure 8.38 – Parent Device Group
In this way, any rule created in Prisma will apply to all nodes in remote networks, mobile users, and explicit proxies. If you want to have another parent available for shared policies between the explicit proxy and GlobalProtect (mobile users), you can add another layer via Panorama | Device Groups.
As you can see in the...
