Global Policy, EU Logging Exception and Duplicate Objects in Strata Cloud Manager

Structure by scope of intent, not by device:

• Global folder: shared objects and the baseline security rule set, expressed as snippets (for example baseline-egress, baseline-inbound, baseline-decrypt) so the same rule bundle can be attached in more than one place and versioned independently.
• Regional folders (NA, EU, APAC): region-specific rules and overrides, plus variables. Variables carry $dns_primary and $dns_secondary per region, and a $url_logging_profile variable that resolves to the EU-restricted logging profile in the EU folder and to the standard profile elsewhere.
• Site folders: only genuinely local objects, such as a branch server or a local ISP next hop.

The critical judgement is rule order. Inherited rules from a parent folder are evaluated before rules added in a child folder, so a child rule cannot override an earlier parent allow or deny. If the EU exception needs to change the outcome of a baseline rule, it cannot simply be added below it; either move the contested rule down into the regional folders and keep only default-deny at global level, or express the difference through the variable that the global rule references. For the logging requirement, the variable approach is cleaner: same rule, different logging profile. Review the resulting effective rule order per folder before pushing, because the evaluation order is where hierarchy designs fail.

Duplicate object names across scopes are legal but dangerous: a reference resolves to the nearest scope, so two engineers can believe they are editing the same object while changing different addresses. That is how object-conflict push failures appear when a folder is moved or a rule is re-parented.

Sequence:

1. Export the effective configuration and list every web-srv with its folder path, address and referencing rules. Do not rename first; you will lose the mapping.
2. Classify: true duplicates with identical addresses (consolidate upward, delete the copies), and same-name different-address objects (rename with a region prefix such as eu-web-srv-01, then repoint references explicitly).
3. Change references and objects in the same commit, at low-traffic time, one folder at a time, verifying with a config diff and a traffic check per site. Renaming before repointing silently breaks rules that fall through to default-deny.

For rule 14 shadowed by rule 9: confirm with the policy analyser what traffic rule 14 can still match. If rule 9 is broader and intended, delete rule 14 and record it; if rule 14 was meant to carve out an exception, narrow rule 9 or move rule 14 above it. Never delete a shadowed rule just because the tool flags it; shadowing is sometimes deliberate and documented.

Separate management plane from dataplane hypotheses. SCM changes policy and objects; it does not forward packets, so it can only cause latency indirectly by pushing a heavier or different rule set, an altered decryption policy or a profile change.

Triage order:

• Correlate the alert window with the configuration push history and the content version. If the latency started at the push, diff the effective configuration for those three branches and look for new decryption, new application inspection or a changed profile.
• Compare the three branches against a fourth branch on the same content version that was not pushed, and against branches on the previous version. A content-only correlation with no config delta points at the update and the device, not SCM.
• Check the local device: dataplane and management CPU, session counts, threat and decryption logs, and whether the PA-440 is at its inspection ceiling. Branch-size firewalls commonly degrade when a new content version increases per-session inspection cost.
• Check path and ISP metrics, and the SaaS experience data if ADEM agents exist, to rule out an upstream provider event that merely coincided.

Conclusion: SCM is responsible only if a configuration delta explains the change; otherwise treat it as a content or capacity issue, and either defer the update for that cohort or move the three sites to a slower rollout ring.