Multi-Site Firewall Consolidation on Panorama

Problem

The client had acquired several regional brands over five years, each with independently managed Palo Alto firewalls. The result was 47 firewalls across 30+ sites with no centralized management, inconsistent naming conventions, overlapping rule bases, and no standard logging configuration. The security team spent most of their time troubleshooting policy conflicts rather than improving security posture. Audit findings repeatedly flagged inconsistent firewall management as a material risk.

Approach

We extracted and normalized the rule base from all 47 firewalls into a structured dataset, which revealed 12,000+ rules with significant overlap and 3,400+ rules that had zero hits in 90 days. We designed a Panorama device group hierarchy aligned to the client's site classification (DC, regional hub, branch), built standardized security profiles and rule templates, and created a migration path that onboarded firewalls in waves of 8-10. Each wave included pre-migration rule analysis, Panorama onboarding, policy push validation, and a 72-hour monitoring period before proceeding.

Results

• 47 firewalls consolidated under centralized Panorama management
• Rule count reduced from 12,000+ to 4,500 (62% reduction)
• 3,400+ unused rules identified and removed
• Policy change deployment time reduced from days to minutes
• Consistent logging and alerting across all sites