topic Re: Template query in Panorama Discussions

Template query

vishalrsshah — Sun, 24 Nov 2024 17:50:01 GMT

Hi All,

I have integrated 2 palo alto in HA and accordinly template has been created like such

1). PA_FW_1

2). PA_FW_2

3). PA_FW_1_Stack

Now client told me to delete PA_FW_1 and PA_FW_2 and keep PA_FW_1_Stack which contains both devices. Can anyone let me know the consequences if i delete both the template

Re: Template query

PavelK — Mon, 25 Nov 2024 04:35:26 GMT

Hello @vishalrsshah

thanks for post!

Based on what you described you are removing 2 Templates from Template Stack leaving Template Stack empty. Template Stack is a unit that holds Template configuration and assigns it to Firewalls. After you remove both Templates and commit / push that configuration to Firewalls you will be removing Panorama pushed configuration. This will be effectively rollback to local configuration.

Do you have more context what client intends to do?

Kind Regards

Pavel

Re: Template query

vishalrsshah — Mon, 25 Nov 2024 05:50:33 GMT

Hi,

Pls find attached snapshot where i have integrated two firewalls and template has been created by panorama. What i wants to know can i delete PA-FW01, PA-FW02, PAFW03, PAFW04 and keep only PA-FW01_02_STACK and PA-FW03_04_STACK and global settings.

Re: Template query

PavelK — Mon, 25 Nov 2024 06:23:39 GMT

Hello @vishalrsshah

thank you for reply.

Since I do not know what configuration is included in each of the Template, I am not able to answer whether you can remove them and what the impact would be.

If the configuration in Global Settings Template is the same/overlapping with PA-FW01, PA-FW02, PAFW03, PAFW04, then it is safe to remove them as Template at the top of the Stack has the highest priority in the presence of overlapping config. In this case there will be no impact.

If the configuration in PA-FW01, PA-FW02, PAFW03, PAFW04 has different / non-overlapping configuration, then deleting these Templates and committing it to Firewalls will have an impact to remove configuration.

To remove the Templates, you should first remove it from Template stack, then you can delete Template itself.

Kind Regards

Pavel

Re: Template query

vishalrsshah — Tue, 26 Nov 2024 19:48:07 GMT

Hi ,

I have deleted PA_FW_2 template and push the configuration alongwith with some other changes also. Now my both firewall have the same hostname. What can I do so my passive firewall will have its own hostname i.e PA_FW_2

Re: Template query

PavelK — Wed, 27 Nov 2024 06:50:02 GMT

Hello @vishalrsshah

thank you for reply.

This is something that can be done with Template variables. The Hostname in Template Variable has been added in PAN-OS 11.1. Below are references:

new-template-variables

configure-template-or-template-stack-variables

If you are not running Panorama on PAN-OS 11.1, then the only option left is to configure hostnames locally or use different Template Stacks for each Firewall.

Kind Regards

Pavel

Re: Template query

vishalrsshah — Wed, 25 Dec 2024 18:15:05 GMT

Thank you for sharing the article. However I have deleted Palo Alto fw2 template due to this facing an problem of same hostname of both primary and Secondary fw. Can I use template variable in template stack and select pa fw2 while commit and push to devices?

Re: Template query

PavelK — Thu, 02 Jan 2025 23:31:05 GMT

Hello @vishalrsshah

thank you for reply.

Here is the video tutorial: TechDocs: Configure a Template or Template Stack Variable. The configuration is done directly in Template / Template Stack and there is no option to control it while pushing to to Firewalls.

Kind Regards

Pavel