Tags allow you to identify the purpose or
function of a rule, and help you better organize your rulebase.
PAN-OS 9.0 replaces the tag browser with the Tag Based Rule Groups,
and introduces the ability to assign group tags to rules. After
your rules are assigned to a tag group, you can view the rulebase
as tag groups to visually group rules based on the tagging structure
you created. When viewing the rulebase as tag groups, you can perform
operational procedures such as adding, deleting or moving the rules
in the selected tag group more easily. Viewing the rulebase as tag
groups maintains the rule evaluation order. A single tag may appear
multiple times throughout the rulebase in order to visually preserve
the rule hierarchy.
In order to assign a group tag to a rule,
you must first create the tag and assign it to a policy rule on
upgrade to PAN-OS 9.0. Policy rules that are already tagged have
the first tag automatically assigned as the Group tag. Before upgrading
to PAN-OS 9.0, review the tagged rules in your rulebase to ensure
rules are correctly grouped upon upgrade. You must manually edit
each tag rule and configure the correct Group tag if your rules
are grouped incorrectly once you upgrade to PAN-OS 9.0.