An engineer is designing a deployment of multi-vsys firewalls.
What must be taken into consideration when designing the device group structure?
An engineer is designing a deployment of multi-vsys firewalls.
What must be taken into consideration when designing the device group structure?
When designing the device group structure for multi-vsys firewalls, it is important to consider that multiple virtual systems (vsys) and firewalls can be assigned to a device group. Additionally, a multi-vsys firewall can have each vsys in a different device group. This allows for flexibility in managing and configuring various virtual systems within the same firewall under different device groups.
Answer is B. I worked in an environment like this in my last job. The multi-vsys firewalls were in different Device Groups.
B according to this link https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClETCA0
B is correct
B is correct. A device group can have multiple members, every vsys can be in a different device group
On the 1/23/24 exam
Still think it should be answer B: If I read the following, I understand that one FW or vsys can only be assigned to one device group, But multiple different FW's or vsys can be assigned to the same device group. #"Firewalls can belong to only one device group but, because virtual systems are distinct entities in Panorama, you can assign virtual systems within a firewall to different device groups." #DEVICE GROUP SETTINGS - DESCRIPTION #Devices; Select each firewall that you want to add to the device group. src; https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-web-interface-help/panorama-web-interface/panorama-device-groups
Answer:A >Only one vsys or one firewall can be assigned to a device group, >and a multi-vsys firewall can have each vsys in a different device group. From Docs: #You can assign any one firewall or virtual system (vsys) to only one device group. #Panorama automatically creates one device group for each firewall or one device group for each virtual system (vsys) in a multi-vsys firewall. https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/manage-device-groups/create-a-device-group-hierarchy https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-to-panorama-management
Yes, I agree with you.
There is a huge difference between: You can assign any one firewall or virtual system (vsys) to only one device group and Only one vsys or one firewall can be assigned to a device group The first is a firewall or vsys can only be in one device group (correct), the second is each device group can have only one firewall or vsys assigned to it (incorrect).
either B or C https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-new-features/panorama-features/device-group-push-to-a-multi-vsys-firewall