Panorama Templates and default vsys settings?

Sec101 — Fri, 04 Jan 2019 21:51:06 GMT

What is the purpose/consequence of a having a template with a default vsys set to either : vsys1 or None -

This is found under: panorama/templates/(specific template name)/Default VSYS/(option of vsys1 OR None)

I'm finding that our firewalls with multiple vsys defined, have the setting to "None". On our global templates (templates used across multiple firewalls in our panorama instance), which don't tie to a specific firewall, but are in the same stack, the setting is "vsys1", yet all firewalls and virtual systems still inherit these settings. I'm hearing that all firewalls have to have a vsys1(default vsys) in order to pass traffic locally. What I don't know is, is that vsys1 required to be set at the panorama level when you setup a new template, or can you set it to none?

Would setting our global templates to "None", have implications on our firewalls that don't have multiple vsys?

From another posted question on live:

https://live.paloaltonetworks.com/t5/General-Topics/Change-the-name-for-vsys1/m-p/215338/highlight/true#M62486

What I am not sure is if you could have a multi-vsys firewall without vsys1.

Re: Panorama Templates and default vsys settings?

BPry — Tue, 08 Jan 2019 20:55:22 GMT

@Sec101,

You will always have vsys1 as far as the system is concenered, even in a multi-vsys setup.

topic Panorama Templates and default vsys settings? in General Topics

Panorama Templates and default vsys settings?

Re: Panorama Templates and default vsys settings?