| Where Can I Use This? | What Do I Need? |
|---|
- NGFW (Managed by Panorama)
|
- Device Management License
- Panorama administrator or device group administrator
role
|
When you push configuration changes to
Device Groups, by default Panorama pushes
all shared and device-group-specific objects to firewalls whether or not any shared
or device group policy rules reference the objects. However, you can configure
Panorama to push only the shared objects that rules reference in the device groups.
The
Share Unused Address and Service Objects with Devices
option enables you to limit the objects that Panorama pushes to the managed
firewalls.
When
Share Unused
Address and Service Objects with Devices is disabled,
Panorama ignores the
Target firewalls when
you
Push a Policy Rule to a Subset of Firewalls. This means
that all objects referenced by any rules are pushed to all firewalls
in the device group.
To limit the number of objects pushed
to a set of managed firewalls, add the policy rules to a child device
group and reference shared objects as needed. See
Create a Device Group Hierarchy for more information
on creating a child device group.
On lower-end models,
such as the PA-220, consider pushing only the relevant shared objects
to the managed firewalls. This is because the number of objects
that can be stored on the lower-end models is considerably lower
than that of the mid- to high-end models. Also, if you have many
address and service objects that are unused, clearing Share
Unused Address and Service Objects with Devices reduces
the commit times significantly on the firewalls because the configuration pushed
to each firewall is smaller. However, disabling this option might
increase the commit time on Panorama because Panorama has to dynamically
check whether policy rules reference a particular object.
