Re: Understanding on Panorama Templates

Sanssj — Fri, 31 May 2019 07:14:23 GMT

In an event of failure of this stand alone deployed Panorama box (log collection and device management) from where will the firewall gets the the templates(Networ & device settings) information since I dont see this information in the local Firewall device config file.
is it ideal to manage the devices settings (HA, Admin roles, Authenction profiles,server profiles etc) via Panorama in a stand alone deployment or is it ideal to have them configured locally on the device.

In the same scenario as mentioned above how do we remove the override cog wheel on the local FW device if you decide to manage everthing from Panorama. one way i could think of is " force the template values" (only when there are like to like values on the Template and on the local device) is there any other way.

Re: Understanding on Panorama Templates

BatD — Fri, 31 May 2019 12:15:01 GMT

@Sanssj

It is generally safe to manage everything from Panorama and everything will work in case of Panorama failure.

The local firewall keeps the following configuration files:

“running-config” – this is local firewall configuration

“sp-config” - holds config pushed from Panorama Devcie Groups for each vsys

“template-config” – this is config pushed from Panorama Templates

When you do config push from Panorama, the relevant firewall config files are updated, but then kept locally and nothing is lost if you lose connectivity to Panorama.

You can override template values locally on the firewall and I am not aware of a way to disable that. “Force template values” will force network and device tab config over the settings locally configured on the firewall, but will not prevent local admins to override the same values again after that.

topic Re: Understanding on Panorama Templates in General Topics

Re: Understanding on Panorama Templates

Re: Understanding on Panorama Templates