Preview Rules to view a list of all rules before you push the rules to the managed firewalls. Within each rulebase, the hierarchy of rules is visually demarcated for each device group (and managed firewall) to make it easier to scan through a large numbers of rules.
When you add a new rule, static operational data for the rule are displayed. The universally unique identifier (UUID) column displays the 36-character UUID for the rule. The firewall generates the UUID on a per-rule basis. However, if you are pushing rules from Panorama, these rules have the same UUID, which is also displayed in the Combined Rules Preview. The Created column displays the time and date the rule was added to the rulebase. Additionally, the
Modified column displays the time and date for the last time the rule was edited. If a policy rule was created before upgrading to PAN-OS 9.0, the
First Hit data is used to establish the
Created date. If no
First Hit data is available for the rule, the time and date the firewall or Panorama management server was upgraded to PAN-OS 9.0 is used to establish the
Created date.
When you add or edit a rule in Panorama, a Target tab displays. You can use this tab to apply the rule to specific firewalls or descendant device groups of the
Device Group (or Shared location) where the rule is defined. In the
Target tab, you can select
Any (default), which means the rule applies to all the firewalls and descendant device groups. To target specific firewalls or device groups, deselect
Any and select specific firewalls or device groups by name. To exclude specific firewalls or device groups, deselect
Any, select the specific firewalls and device groups by name, and select
Target to all but these specified devices. If the list of device groups and firewalls is long, you can apply Filters to search the entries by attributes (such as Platforms) or by a text string for matching names.
After you successfully add and push a rule in Panorama, Rule Usage displays whether the rule is Used by all devices in the device group, Partially Used by some devices in the device group, or Unused by devices in the device group. Panorama determines rule usage based on managed firewalls with Policy Rule Hit Count (enabled by default). In the Panorama context, you can view the rule usage for a Shared policy rule across all device groups. Additionally, you can change the context to an individual device group and view the total policy rule usage across all devices in the device group.
Preview Rules will show the
Hit Count,
Last Hit, and
First Hit for each policy rule for the device group. The total traffic hit count, as well as the first and last hits timestamps, persist through reboot, upgrade, and dataplane restart events. See
Monitor Policy Rule Usage.
Group Rules by Tag to apply a tag that allows you to group like policy rules for better visualization of rule functions and provides easier management of policy rules across your rulebase. Rules grouped by tags show the list of tag groups, but maintain the rule priority listing. You can append rules to the end of a tag group, move rules to a different tag group, apply additional tags to rules in a tag group, and filter or search using the group tag.
To track changes to policy rules, add an Audit Comment to describe the changes you make to and why a rule was created or modified. After you enter an audit comment is entered and configuration change is committed, the audit comment is preserved in the
Audit Comment Archive where you can view all previous audit comments for the selected rule. You can search for the audit comment in Global Find. The Audit Comment Archive is read-only.