Device groups comprise firewalls and virtual systems you want to manage as a group, such as firewalls that manage a group of branch offices or individual departments in a company. Panorama treats each group as a single unit when applying policies. A firewall can belong to only one device group. Because virtual systems are distinct entities in Panorama, you can assign virtual systems within a firewall to different device groups.
nest device groups in a tree hierarchy
of up to four levels under the Shared location to implement a layered approach for managing policies across the network of firewalls. At the bottom level, a device group can have parent, grandparent, and great-grandparent device groups at successively higher levels—collectively called ancestors—from which it inherits policies and objects. At the top level, a device group can have child, grandchild, and great-grandchild device groups—collectively called descendants. In the
page, the Name column reflects this hierarchy.
After adding, editing, or deleting a device group, you must perform both a Panorama and device group commit (see
Commit Your Changes in Panorama). Panorama then pushes configuration changes to firewalls assigned to the device group. To configure a device group, click
and complete the following fields.