Tags allow you to group objects using keywords or phrases. You can apply tags to address objects, address groups (static and dynamic), zones, services, service groups, and to security rules. You can also use an SD-WAN Interface profile to apply a link tag to an Ethernet interface. You can use tags to sort or filter objects and to visually distinguish objects by color. When you apply a color to a tag, the Policy tab displays the object with a background color. Each object can have up to 64 tags. When an object has multiple tags, it displays the color of the first tag applied.

You must create a tag before you can group rules using that tag. A predefined tag named Sanctioned is available for tagging applications objects. When you create a new tag, the tag is automatically created in the Virtual System or Device Group that is currently selected on Panorama.