Palo Alto Networks Knowledgebase: How to Duplicate Device Groups on Panorama

How to Duplicate Device Groups on Panorama

Created On 08/05/19 19:22 PM - Last Updated 08/05/19 19:48 PM
Cortex Data Lake Panorama



Device Groups (DG) in Panorama are used to build configurations that are shared among the managed firewalls. Policy and address objects configurations are pushed to the managed firewalls within Device Groups.


At times, the Panorama administrator may need to clone a device group for efficiency and make further edits to customize the device group for a new set of managed firewalls. This task can be performed from the CLI using the method described below.


Important: This process requires an administrator account with ‘superuser’ privileges to run the command and issue a commit.


The command, load configure partial <attributes>, can be used to merge the XML elements from a certain XPath in a Panorama configuration.



  1. The devices from the original device group will be moved to the new device group. For example, 36-AP-500 is being moved to DG_clone.
  2. The new device group's Parent Device Group will be Shared. If it is necessary for it to have the same parent as the original, then go to Panorama > Device Groups > DG_clone and change the Parent Device Group to the correct DG



First, the configuration must be imported into Panorama. The configuration can be imported from the web-interface or the CLI. The example below will use the predefined ‘running-config.xml’ file which stores the current running configuration on the Panorama server. Whenever a successful commit is completed in Panorama, the configuration is saved to the ‘running-config.xml’ file.


Following is the snapshot of the Device Group, DG_1, as seen from the web-interface:


The Device Group, DG_1, already exists in the Panorama running-config.xml file. This is the Device Group that will be cloned/duplicated, and the new DG will be named, DG_clone. Run the following command to create DG_clone as a clone of DG_1:


# load config partial from running-config.xml from-xpath /config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='DG_1'] to-xpath /config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='DG_clone'] mode merge


Config loaded from running-config.xml





The above command uses 'running-config.xml' as the source configuration and DG_clone for the name of the newly created clone configuration. Enter the appropriate configuration file if different from 'running-config.xml'. The mode used in the command must be specified as ‘merge’ (as seen in the above example).


A new DG with the name, DG_clone, is created after the command above is performed. The following screenshot shows DG_clone in the list of Device Groups:


owner: kadak

  • Print
  • Copy Link

Choose Language