Manage Unused Shared Objects

When you push configuration changes Device Groups, by default Panorama pushes all shared objects to firewalls whether or not any shared or device group policy rules reference the objects. However, you can configure Panorama to push only the shared objects that rules reference in the device groups.The
Share Unused Address and Service Objects with Devices
option enables you to limit the objects that Panorama pushes to the managed firewalls.
When
Share Unused Address and Service Objects with Devices
is disabled, Panorama ignores the
Target
firewalls when you Push a Policy Rule to a Subset of Firewalls. This means that all objects referenced by any rules are pushed to all firewalls in the device group.
To limit the number of objects pushed to a set of managed firewalls, add the policy rules to a child device group and reference shared objects as needed. See Create a Device Group Hierarchy for more information on creating a child device group.
On lower-end models, such as the PA-200, consider pushing only the relevant shared objects to the managed firewalls. This is because the number of objects that can be stored on the lower-end models is considerably lower than that of the mid- to high-end models. Also, if you have many address and service objects that are unused, clearing
Share Unused Address and Service Objects with Devices
reduces the commit times significantly on the firewalls because the configuration pushed to each firewall is smaller. However, disabling this option might increase the commit time on Panorama because Panorama has to dynamically check whether policy rules reference a particular object.
  1. Select
    Panorama
    Setup
    Management
    , and edit the Panorama Settings.
  2. Clear the
    Share Unused Address and Service Objects with Devices
    option to push only the shared objects that rules reference, or select the option to re-enable pushing all shared objects.
  3. Click
    OK
    to save your changes.
  4. Select
    Commit
    Commit to Panorama
    and
    Commit
    your changes.

Related Documentation