Active/Active Firewalls and Panorama Templates

tcasw86 — Wed, 27 Mar 2019 22:06:55 GMT

So I'm trying to keep firewall configuration as much in Panorama as possible. With Active/Passive I can accomplish this with one template per firewall pair.

With an active/active firewall pair will I need a template stack to do this? One template per firewall, then a template to cover both, in a template stack? Is there an easier way to do this, while still keeping configuration in Panorama?

Re: Active/Active Firewalls and Panorama Templates

jeremy.larsen — Thu, 28 Mar 2019 13:33:57 GMT

This one got me for awhile back when I did it. You are correct. You need to create separate templates ie - templateA & templateB. Then create a stack for each as well - stackA & stackB. The top template of each stack will be the templates mentioned above (highest priority, top to bottom). Usually I only include things specific the each firewall in these (HA configs, Hostname, etc). Once this is done, I will create a template for the pair/site/global. It's really up to you how you want to organze this. One thing to remember that had me hung up. A stack does not mean a stack of firewalls (ie - switch stack). It only means a stack of templates to be applied to a firewall. Let me know if the below example helps.

Example:

templateA (contains template specific to firewallA, ie - HA configs, hostname, etc)

templateB (contains template specific to firewallB, ie - HA configs, hostname, etc)

templateSite (contains template specific to the site HA pair)

stackA (contains templateA + templateSite + anything others) -> applied to FirewallA (in order top to bottom)

stackB (contains templateB + templateSite + anything others) -> applied to FirewallB (in order top to bottom)

topic Active/Active Firewalls and Panorama Templates in General Topics

Active/Active Firewalls and Panorama Templates

Re: Active/Active Firewalls and Panorama Templates