You can tag objects to group related items and add color to the tag in order to visually distinguish them for easy scanning. You can create tags for the following objects: address objects, address groups, user groups, zones, service groups, and security rules.

Both static tags and dynamic tags are supported. Dynamic tags are registered from a variety of sources and are not displayed with the static tags because dynamic tags are not part of the configuration. See Register IP Addresses and Tags Dynamically for information on registering tags dynamically. The tags discussed in this section are statically added and are part of the configuration.

You can apply one or more tags to objects and to security rules, up to a maximum of 64 tags per object. Panorama supports a maximum of 10,000 tags, which you can apportion across Panorama (shared and device groups) and the managed devices (including devices with multiple virtual systems).

Use tags to identify the purpose of a rule or configuration object and to help you better organize your rulebase. To ensure that security rules are properly tagged, see how to Enforce Security Rule Description, Tag, and Audit Comment. Additionally, you can View Rules by Tag Group (Panorama only) by first creating and then setting the tag as the Group tag.