After adding firewalls (see Add a Firewall as a Managed Device), you can group them into Device Groups (up to 256), as follows. Be sure to assign both firewalls in an active-passive high availability (HA) configuration to the same device group so that Panorama will push the same policy rules and objects to those firewalls. PAN-OS doesn’t synchronize pushed rules across HA peers. To manage rules and objects at different administrative levels in your organization, Create a Device Group Hierarchy.
Add a Device Group
Select Panorama > Device Groups, and click Add.
Enter a unique Name and a Description to identify the device group.
In the Devices section, select check boxes to assign firewalls to the group. To search a long list of firewalls, use the Filters. You can assign any firewall to only one device group. You can assign each virtual system on a firewall to a different device group.
( Optional ) Select Group HA Peers for firewalls that are HA peers. The firewall name of the passive or active-secondary peer is in parentheses.
Select the Parent Device Group (default is Shared) that will be just above the device group you are creating in the device group hierarchy.
If your policy rules will reference users and groups, assign a Master firewall. This will be the only firewall in the device group from which Panorama gathers username and user group information.
Click OK and Commit, for the Commit Type select Panorama, and click Commit again.
Click Commit, for the Commit Type select Device Group, select the device group you just created, and click Commit again.

Related Documentation