topic Managing HA Settings of firewall locally instead of managing it from Panorama in Panorama Discussions

Managing HA Settings of firewall locally instead of managing it from Panorama

tamilvanan — Wed, 29 Dec 2021 14:50:30 GMT

Hi Folks,

We had recently migrated HA firewall to Panorama using the below documentation

Migrate a Firewall HA Pair to Panorama Management:

https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-ha-pair-to-panorama-management.html

As per below documentation once the migration had been completed the HA settings and management IP address of the HA firewall need to be managed locally on the firewall by over-riding the template values.

Also both the HA firewalls are in same template group which indicates that we will not be able to manage the firewall.

But the customer is not OK with it and need to manage HA settings and everything from Panorama itself.

We are thinking about creating an common template containing all the required changes for both the firewalls and create two template stack for each firewall and call the template in those template stacks.

Then create two separate template dedicated for HA Settings, Management IP address configuration and other things which will be different from both the firewalls and map primary firewall HA temp config to Primary firewall stack and do the same for Secondary firewall temp and map it to secondary firewall also.

Please let me know if this approach is correct.

Temp 1 == all common settings, temp 2= Primary HA Settings, Temp 3 = Sec HA Settings\\\ Temp stack 1(Primary FW)== temp1, temp 2. \\\temp stack 2(Secondary FW) = temp1, temp 3

Thanks in advance

Re: Managing HA Settings of firewall locally instead of managing it from Panorama

PavelK — Thu, 30 Dec 2021 02:39:45 GMT

Thank you for the post @tamilvanan

First of all, I agree with you that it is better and safer to managed HA locally instead of using Panorama. Overall, your design of Templates/Template Stack looks good and to me it looks functional. The only thing I am worried about is pushing of setting from Template (HA setting, interfaces,..) will not be applied if Firewall has already existing overlapping configuration. You will have to override it locally to apply Panorama pushed configuration: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UgMCAU&lang=en_US%E2%80%A9 Alternative approach is to select: "Force Template Values" while pushing configuration, but this involves risk that local config that is not included in Template will be wiped, so I would go with overriding it locally as this is only one time job.

Could you please post back how well this went? I am wondering how smooth it was.

Kind Regards

Pavel

Re: Managing HA Settings of firewall locally instead of managing it from Panorama

d.spider — Thu, 30 Dec 2021 07:17:23 GMT

Whatever you have mentioned had worked well in my case. I had overridden local settings on firewall first. Just sharing my experience. Thank you