def get_all_rules_for_dg(device_group, device_group_hierarchy_parent, devicegroup_objects):
    """
    Per https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/panorama-overview/centralized-firewall-configuration-and-update-management/device-groups/device-group-policies
    The order is: pre-rules top-down, local rules, then post-rules bottom up.

    :param device_group: Device Group to get rules for
    :param device_group_hierarchy_parent: dict mapping device group to parent device groups
    :param devicegroup_objects:
    :return: List of tuples: (device group, rule type, rule entry)
    """
    dg_hierarchy = [device_group]
    current_dg = device_group_hierarchy_parent.get(device_group)
    while current_dg:
        dg_hierarchy.append(current_dg)
        current_dg = device_group_hierarchy_parent.get(current_dg)

    all_rules = []
    rule_type = 'SecurityPreRules'
    for dg in dg_hierarchy[::-1]:
        for rule in devicegroup_objects[dg][rule_type]:
            all_rules += [(dg, rule_type, rule)]

    # Doesn't support local rules yet

    rule_type = 'SecurityPostRules'
    for dg in dg_hierarchy:
        for rule in devicegroup_objects[dg][rule_type]:
            all_rules += [(dg, rule_type, rule)]

    return all_rules