4.3 Device Groups, Shared Rulestacks, and Policy Hierarchy

4.3 Device Groups, Shared Rulestacks, and Policy Hierarchy

While Templates and Template Stacks handle network layer configurations, Device Groups control security enforcement across Palo Alto Networks Next-Generation Firewalls. Device Groups organize firewalls into logical hierarchies, allowing security administrators to push global security rules, NAT policies, decryption profiles, and security objects while preserving regional and local policy flexibility.

---

Device Groups and Hierarchy

A Device Group is a logical collection of firewalls that share security policy rulebases and security objects (such as Address Objects, Service Objects, Application Groups, and Security Profiles).

The Device Group Inheritance Tree

Device Groups are structured in a multi-tier tree hierarchy:

• Shared (Root Level): The ultimate parent container. Objects and policies created in Shared are visible to and inherited by all Device Groups and all managed firewalls across the entire enterprise.
• Parent Device Groups: Organizational containers representing major divisions, regions, or environments (e.g., Americas-DG, EMEA-DG, DataCenter-DG).
• Child Device Groups: Sub-containers inheriting all rules and objects from their parent group while introducing specialized local rules (e.g., Americas-Retail-DG inheriting from Americas-DG).
• Target Firewalls: Individual firewalls assigned to leaf Device Groups in the tree.

                  [ Shared ] (Root Container)
                      |
        +-------------+------------+
        |                          |
 [ DataCenter-DG ]          [ Enterprise-Branches-DG ]
        |                          |
  +-----+-----+              +-----+----+
  |           |              |          |
[DC-East] [DC-West]       [US-East]  [EU-Central]

---

Policy Hierarchy and Rule Evaluation Order

On any managed firewall, incoming traffic sessions are evaluated against security rules in a strict, deterministic sequence. Panorama enforces a three-tier rulebase hierarchy composed of Pre-Rules, Local Rules, and Post-Rules.

1. Pre-Rules (Pushed from Panorama)

Pre-Rules are created in Panorama and pushed to managed firewalls at the top of the security policy rulebase. They are evaluated FIRST, before any local rules on the firewall.

• Purpose: Enforce mandatory global security policies, enterprise compliance standards, and urgent threat blocks (e.g., blocking known malicious IP feeds, restricting outbound unauthorized administrative protocols, enforcing corporate DNS security).
• Local Override Prevention: Local firewall administrators cannot move, edit, or bypass Panorama Pre-Rules.

2. Local Rules (Configured on Managed Firewall)

Local Rules are created directly on the managed firewall by site administrators or pushed via local firewall management interfaces. They are evaluated SECOND, after Panorama Pre-Rules and before Panorama Post-Rules.

• Purpose: Allow site-specific traffic flows, local server access, and custom branch rules unique to that location.
• Scope: Local rules only exist on the specific firewall where they are created.

3. Post-Rules (Pushed from Panorama)

Post-Rules are created in Panorama and pushed to managed firewalls at the bottom of the security policy rulebase. They are evaluated THIRD, after all local firewall rules have been inspected.

• Purpose: Provide standard default fallthrough logic, clean-up rules, default intra-zone allow policies, or catch-all logging rules across all enterprise firewalls.
• Fallback Role: If traffic does not match any Pre-Rule or Local Rule, it falls through to be evaluated by Post-Rules.

---

Shared Rulestacks and Objects

Panorama manages security objects and policies across Device Groups using shared inheritance:

• Shared Objects: Address objects, Custom App-IDs, URL Categories, and Security Profiles defined in Shared are available across all Device Groups. If a Child Device Group defines an object with an identical name to a Shared object, the child group object overrides the Shared object for firewalls in that child group.
• Rule Movement: Administrators can move rules between Pre-Rules and Post-Rules, or convert local firewall rules into Panorama Pre/Post-Rules using the Take Over / Import functions.
• Target Filtering: Within a Device Group Pre-Rule or Post-Rule, administrators can specify Target Devices. This allows a rule inside a shared Device Group to apply only to designated firewall serial numbers or specific virtual systems (vsys).

---

Device Group Variables

Similar to Template Variables, Device Group Variables allow security policy objects (such as IP addresses, subnets, or domain names inside Address Objects) to use dynamic placeholder values. For instance, a pre-rule blocking local syslog bypass can reference $LOCAL_SYSLOG_SERVER, where the specific IP is resolved dynamically for each firewall in the Device Group.

---

Panorama Commit and Push Execution Workflow

Applying changes in Panorama is a two-step process:

[ Candidate Config ] --(Commit to Panorama)--> [ Panorama Active Config ]
                                                       |
                                             (Push & Commit to Devices)
                                                       |
                                            [ Managed Firewall Config ]

Step 1: Commit to Panorama

Select Commit > Commit to Panorama. This operation validates, compiles, and saves all candidate configuration edits made by administrators into Panorama's active running configuration. It does not send changes to managed firewalls.

Step 2: Push to Devices

Select Commit > Push to Devices. This operation deploys compiled configuration blocks from Panorama to target managed firewalls. Push options include:

• Device Group Selection: Choose specific Device Groups or individual firewalls for policy deployment.
• Include Device and Network Templates: Check this box to push Template Stack network/device settings simultaneously with Device Group security policies.
• Force Template Values: Overwrites local network/device settings on target firewalls.
• Preview Changes: Generates a visual diff comparing candidate changes against the running configuration on target firewalls before execution.

---

Policy Rulebase Tier Comparison