Use device groups to group the firewalls in your network into logical units. You can group firewalls based on network segmentation, geographic location, organizational function, or common aspects requiring similar policy configurations. You can create a device group hierarchy to organize device groups hierarchically, with shared rules and objects at the top, and device group-specific rules and objects at subsequent levels.

Administrators can create objects for use in shared or device group policy allowing you to use an object in any policy rule that is in the shared location, or in the same device group as the object, or in descendants. To optimize deployments, you can manage unused shared objects that help you limit the objects that Panorama pushes to the managed firewalls.

Administrators can streamline configuration by defining objects, such as IP addresses, services, and security profiles—once and reusing them across the network. Objects defined within a specific Device Group are available to that group and its descendant device groups. While descendants automatically inherit these objects, administrators can Override the inherited values at the lower level to accommodate specific local requirements without renaming the objects.

For policy maintenance, you can move or clone a policy rule or object to a different device group. If a policy rule or object has references to objects that are not available in the target device group, you must move or clone the referenced objects in the same operation. You can also move a firewall from one device group to another by following the proper procedure to avoid validation errors. Finally, you can push a policy rule to a subset of firewalls to specify the firewalls in a device group to which to push policy rules, allowing you to exclude one or more firewalls or apply rules only to specific devices.