Object redefined in a device group that inherits one with the same name
At a glance
Base severity
Area
Platform
Evidence level
Benchmark reference
Reads the export, not the device
ConfigProof reads a configuration export. This control is evaluated against the objects in that file, and it reports what the file says. It does not connect to the device and sees no traffic, so a finding here describes the configuration, not what the firewall is doing right now.
Why it matters
The child definition wins inside that device group and the inherited one wins everywhere else, so one name means two things in one estate. A rule reviewed in Shared and a rule reviewed in the child read identically and permit different traffic.
How to fix it
Web interface
The steps below are written for the web interface. A finding raised on your own export carries the same steps with your object names filled in.
- Confirm the override is deliberate rather than an accidental repeat of a name.
- Where it is deliberate, give the local object a name that says it is local.
- Where it is not, remove the local definition and let the inherited object apply.
Command line
Panorama CLI
delete device-group <device-group> address <object-name>An example. Values in angle brackets are yours to supply; a finding on your own export fills in the names it read. Nothing here commits or pushes. Review, commit, then push to your devices yourself.
Read it back
show device-group <device-group> address <object-name>Values to fill in2
- <device-group>
- The device group that holds the rule
- <object-name>
- The object's name, as it appears on your firewall
Before you type it3
- The managed devices keep running their current policy until you push.
- Removing the local copy restores whatever the parent supplies.
- Before removing the local definition, check what this group expected the name to mean.
How to confirm the fix
- List the rules in the child device group that reference this name and confirm each intends the local value.
- Compare the effective object value on one device in the child device group before and after.
Limits
- Overriding an inherited object is a supported Panorama pattern. This finding reports that it is happening, not that it is wrong.
Compliance references
No benchmark recommendation is mapped to this control in this version.
More in Panorama Advanced
- PAN-MGT-003Identical rule defined in several device groups
- PAN-MGT-004Rule defined in every child of a device group
- PAN-MGT-005Inherited rule treated differently in a child device group
- PAN-MGT-006Rule references an object outside its inheritance chain
- PAN-MGT-008Templates in one stack set the same value differently
- PAN-MGT-009Template stack member whose settings are all supplied above it
- PAN-MGT-010Template stack names a template that does not exist
- PAN-MGT-011Template variable used with no declaration
See it on your own firewall
One complete analysis of one firewall costs nothing. A card is required and nothing is charged.