5.2 SCM Rulestacks, Folder Hierarchies, and Unified Policy Management
Key Takeaways
- SCM organizes security policies using an inheritance-based Folder Hierarchy comprising default root containers (All), functional top-level folders (Corporate, Branch, Cloud, Prisma Access), sub-folders, and device-specific contexts.
- Security policy rules in SCM are managed via modular cloud-delivered Snippets (reusable rule building blocks) and Rulestacks, enabling flexible policy reuse across global enforcement points.
- Policy rule evaluation follows a top-down evaluation order: Global Pre-rules execute first, followed by Parent Folder Pre-rules, Child Folder Pre-rules, Snippet Pre-rules, Local/Device Rules, Post-rules, and System Default Rules.
- The SCM Push & Sync mechanism uses continuous candidate configuration validation, diff generation, and transactional commit operations to push rule updates without network service disruption.
- Conflict resolution between local firewall configurations and SCM policy mandates is enforced through explicit policy precedence, where cloud-managed Pre-rules override local device settings and automatic rollback recovers from broken commits.
5.2 SCM Rulestacks, Folder Hierarchies, and Unified Policy Management
Key Concept: Strata Cloud Manager (SCM) streamlines policy administration by replacing complex Panorama Device Group and Template Stack constructs with an intuitive, inheritance-driven Folder Hierarchy, modular Snippets, and global Rulestacks. This structure ensures consistent Zero Trust security posture across diverse enterprise environments while enabling localized policy adjustments.
In large hybrid enterprises, managing thousands of security rules across firewalls in datacenters, branch offices, and cloud environments creates significant operational complexity. SCM addresses this challenge through an object-oriented policy model. By leveraging hierarchical folder inheritance and modular configuration snippets, security administrators can write a baseline security policy once and push it automatically to every managed physical, virtual, and cloud firewall.
SCM Folder Hierarchy Architecture
The SCM configuration tree is structured as an inverted hierarchy. At the apex sits the root folder, with sub-folders branching down to specific operational contexts. Settings configured in higher-level folders automatically propagate down to all nested sub-folders and managed firewalls.
+------------------+
| ALL (Root) |
| Global Baseline |
+--------+---------+
|
+--------------------+-----------+-----------+--------------------+
| | | |
+------v-------+ +-------v------+ +-------v------+ +-------v------+
| Corporate | | Branch | | Cloud | |Prisma Access |
| Datacenters | | Retail/SDWAN | | AWS/Azure/GCP| | SASE / Users |
+------+-------+ +-------+------+ +-------+------+ +--------------+
| | |
+------v-------+ +-------v------+ +-------v------+
| HQ Datacenter| | Region US-East| | AWS VPC Prod |
+--------------+ +--------------+ +--------------+
Core System Folders
All(Root Folder): The top-level container for global security governance. Security policies, custom App-ID definitions, security profile groups (Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, WildFire), and shared address objects configured here apply across the entire enterprise estate.CorporateFolder: Contains configuration policies tailored for core enterprise infrastructure, including primary datacenters, corporate headquarters, and high-security administrative zones.BranchFolder: Designed for remote offices, retail branches, and SD-WAN locations. Policies here typically focus on branch-to-datacenter connectivity, direct internet breakout security, and standardized branch threat profiles.CloudFolder: Manages public and private cloud firewalls, including VM-Series instances on VMware/AWS/Azure/GCP and Cloud NGFW instances. Policies focus on microsegmentation, east-west traffic inspection, and cloud application security.Prisma AccessFolder: Dedicated container for SASE deployments, managing mobile user security policies, Remote Networks (branch connections), and Service Connections to corporate datacenters.
Modular Policy Elements: Snippets and Rulestacks
SCM introduces two powerful modular policy components that promote policy standardization and prevent configuration duplication: Snippets and Rulestacks.
Cloud-Delivered Snippets
A Snippet is a modular, self-contained configuration package that contains objects, security profiles, and rule definitions. Unlike traditional static templates, Snippets can be attached dynamically to any folder or combination of firewalls regardless of their position in the folder tree.
- Predefined Palo Alto Networks Snippets: SCM includes built-in, expert-curated snippets (such as the Best Practice Security Profiles Snippet or PCI-DSS Compliance Snippet) that provide instant alignment with Zero Trust standards.
- Custom Organizational Snippets: Security teams can create custom snippets for specific operational needs—such as a Third-Party Vendor Access Snippet or VoIP Traffic Management Snippet—and attach them across select Branch and Corporate folders.
Rulestacks
A Rulestack represents an ordered set of security rules (Security, NAT, Decryption, QoS, Authentication, Policy-Based Forwarding) deployed from SCM. Rulestacks distinguish between Pre-Rules (enforced before local firewall rules) and Post-Rules (enforced after local firewall rules).
Policy Rule Evaluation Order
When traffic passes through a firewall managed by SCM, the PAN-OS packet processing engine evaluates Security Policy rules in a strict, top-down sequence. Understanding this evaluation pipeline is critical for troubleshooting policy behavior and resolving access issues.
+-------------------------------------------------------------------------+
| SCM POLICY RULE EVALUATION PIPELINE |
+-------------------------------------------------------------------------+
| 1. GLOBAL PRE-RULES (Root 'All' Folder) -> Mandatory Enterprise Rules|
| 2. PARENT FOLDER PRE-RULES -> e.g., Corporate/Branch |
| 3. CHILD FOLDER PRE-RULES -> e.g., HQ-Datacenter |
| 4. ATTACHED SNIPPET PRE-RULES -> Modular Compliance Rules |
| 5. LOCAL DEVICE PRE-RULES -> Managed Device Local Pre |
| 6. LOCAL DEVICE EXPLICIT RULES -> Local Firewall Rules |
| 7. LOCAL DEVICE POST-RULES -> Managed Device Local Post |
| 8. ATTACHED SNIPPET POST-RULES -> Modular Fallback Rules |
| 9. CHILD FOLDER POST-RULES -> Local Folder Fallbacks |
| 10. PARENT FOLDER POST-RULES -> Regional Fallbacks |
| 11. GLOBAL POST-RULES (Root 'All' Folder) -> Default Interzone Deny |
+-------------------------------------------------------------------------+
The detailed evaluation stages are summarized in the table below:
| Evaluation Stage | Source Container | Administrative Scope & Intent |
|---|---|---|
| 1. Global Pre-Rules | All (Root) Folder | Non-negotiable corporate security baseline (e.g., block known malicious IPs, block high-risk P2P applications). |
| 2. Parent Folder Pre-Rules | Top-Level Folder (Corporate/Branch) | Regional or functional mandatory rules (e.g., require Decryption on all Branch internet egress). |
| 3. Child Folder Pre-Rules | Nested Sub-Folder (HQ-Datacenter) | Specific site mandatory rules (e.g., allow database sync between specific datacenter subnets). |
| 4. Snippet Pre-Rules | Attached Snippets | Specialized modular pre-rules attached to the container context. |
| 5. Local Device Rules | Local Firewall Manager | Specific rules configured locally on the device (if local edits are permitted by SCM administrative settings). |
| 6. Folder Post-Rules | Child / Parent / Global Folders | Fallback rules evaluated after local rules (e.g., shared logging rules or catch-all default actions). |
| 7. Default Rules | PAN-OS System Defaults | System-defined intrazone-default (allow) and interzone-default (deny) rules. |
Push and Synchronization Mechanics
Configuring policies in the SCM web interface updates the Candidate Configuration in the cloud. Pushing these changes to operational firewalls involves a sophisticated synchronization pipeline:
- Validation Engine: Before initiating a push, SCM runs an automated validation check. The engine verifies syntax correctness, confirms object dependency references (e.g., verifying that custom Security Profiles referenced in a rule exist), and detects policy collisions.
- Differential Generation (Diff): SCM calculates the precise delta between the active configuration currently running on the firewall and the new candidate configuration.
- Transactional Commit: SCM transmits the configuration delta over the secure cloud control channel (TCP 443). The target firewall applies the changes in an atomic transaction.
- State Monitoring & Sync Verification: SCM tracks device synchronization state:
- In-Sync: Local firewall active configuration perfectly matches SCM target configuration.
- Out-of-Sync: Firewall has unpushed changes or local modifications that diverge from SCM.
- Pending Commit: Push operation currently in progress.
- Validation Failed: Push blocked due to configuration syntax errors or missing dependencies.
- Automatic Rollback Safety: If a configuration push disrupts management connectivity between the firewall and SCM, the firewall's local PAN-OS Automatic Rollback timer expires (default: 15 minutes). The firewall automatically reverts to its prior functional configuration, restoring management access and preventing remote site lockouts.
Conflict Resolution & Local Configuration Overrides
When transitioning firewalls from standalone management to SCM, conflicts may arise between pre-existing local configurations and SCM cloud policies.
- Rule Precedence: SCM Cloud Pre-rules always take precedence over local firewall rules. A local rule allowing traffic will be rendered ineffective if a higher-level SCM Pre-rule blocks that same traffic.
- Locking Local Configurations: SCM administrators can lock local firewall configurations into read-only mode, preventing local web interface or CLI edits. This enforces strict cloud-centralized governance.
- Importing Local Objects: During onboarding, local firewall objects (Address Objects, Service Groups) can be imported into SCM. SCM detects duplicate object definitions across devices, prompting administrators to consolidate them into shared global objects in the
Allfolder.
In Strata Cloud Manager policy evaluation, where are Global Pre-rules defined, and when are they evaluated?
What is the primary operational function of a Snippet in Strata Cloud Manager?
What happens if a policy push from SCM breaks management connectivity on a remote branch PA-400 firewall?