Migrate Original Policy Sets to Stacked Policy Sets

Select
Manage
Policies
Stacked Policies
Bindings/Path/QoS/Security/NAT
.
Select
Security
Security Stacks
Advanced
Security Sets
Add Set
.
The example shows how to convert an original security policy set to a stacked security policy set. You can extend this to converting Path and QoS sets also.
To migrate from original network policies to stacked network policies, you can clone an original network policy set into two types of stacked policy sets—stacked path policy set (for original network policies) and stacked QoS policy set (for original priority policies) and bind them separately to a site.
On the
Add Security Policy Set
screen, enter a
Name
for the security policy set, and optionally enter description and tags.
While adding a name, ensure that there is no stacked policy set having the same name as the original policy set.
Select the
Clone From an Original Policy Set
check box to clone a policy set created under original policies and select a policy set to clone from the
Choose an Original Policy Set
drop-down.

Click
Done
to submit your changes.
The clone operation creates a new policy set stack for the original security policy set. As part of the clone operation, a policy set containing custom rules from the original policy set and a Default Rule Policy set from the default rules in the original policies is created. The Default Rule Policy set contains three different rules—
default-deny
,
intra-zone-allow
,
self-zone-allow
.
In order for stacked security policy rules to be active, bind security policy set stacks to a site.