topic One template in Panorama for HA pair of firewalls in General Topics

One template in Panorama for HA pair of firewalls

Milan_Lesnik — Fri, 21 Jul 2017 13:24:47 GMT

Transition/migrate HA pair to firewall

I followed those instructions https://www.paloaltonetworks.com/documentation/80/panorama/panorama_adminguide/manage-firewalls/migrate-a-firewall-to-panorama-management#_39720, steps from 1 to 7 and successfully migrated 3 HA pairs to Panorama management.

After migration I've got in Panorama 3 device groups and 6 device templates.

In this document https://live.paloaltonetworks.com/t5/Management-Articles/Any-special-considerations-when-importing-HA-firewall/ta-p/114668 is written that each firewall has to use its own template (bellow special note). This limitation is annoying and can lead to mistakes. After checking template values I think there is no need for this limitation and I think I could put both firewalls into the same template because relevant values for HA aren't part of the template (e.g. High Availability - General - Preemptive - Device Priority).

Is this correct, or has anyone experience with such deployment (two firewalls and one template) in the production (https://live.paloaltonetworks.com/t5/Management-Articles/How-to-add-a-locally-managed-firewall-to-panorama-management/tac-p/165380#M)?

Regards Milan

Re: One template in Panorama for HA pair of firewalls

Remo — Fri, 21 Jul 2017 15:04:32 GMT

Hi @Milan_Lesnik

We already have a lot of such deployments. The dedicated template is only in the migration. After that you're free to change everything you want. You only need dedicated templates when you use them for settings which aren't the same on both firewalls.

In your case it is no problem to use one template for both clustermembers. In my case we use template stacks which contain multiple templates (global settings template, clustersettings template and devicespecific templates for each firewall with settings like mgmt ip, hostname ...)

Just keep in mind that you need to delete the devicespecific values from the import templates and the you could apply this one template to both firewalls of your HA pair.

Hope this helps.

Regards,

Remo

Re: One template in Panorama for HA pair of firewalls

Milan_Lesnik — Sat, 22 Jul 2017 19:32:39 GMT

It helps, thank you for the answer.

During migration dedicated template, after migration one template for both firewalls.

Regards Milan