Assigning a template to a specific vsys within a Template Stack?

rolinger — Mon, 03 Aug 2020 00:59:38 GMT

Most of our FWs are multi-vsys. Our stacks basically consist of one template - the entire FW config. Now we are trying to create more global templates that we can apply to multiple Template Stacks. But when creating a new template configs, the config sections only gives you the option of assigning it to "Location: None" or "Location: vsys1"

On one HA pair we have 5 vsys. On another pair we have 3 vsys.

FW-Pair-1:

vsys-corp (vsys1)

vsys-guest (vsys2)

vsys-proxy (vsys3)

vsys-dmz (vsys4)

vsys-finance (vsys5)

FW-Pair-2:

vsys1 (vsys1)

vsys-guest (vsys2)

vsys-prox (vsys3)

The configs we are adding to the new template, the "Location: vsys1" is set and then we added to template to each of the template stacks. When the configs pushed to the FW, this was the new result:

FW-Pair-1:

vsys-corp (vsys1)

vsys-guest (vsys2)

vsys-proxy (vsys3)

vsys-dmz (vsys4)

vsys-finance (vsys5)

vsys1 (vsys6) <-- new configs went here! (it created a new vsys and did not put them on vsys1)

FW-Pair-2:

vsys1 (vsys1) <-----new configs went here (which was correct)

vsys-guest (vsys2)

vsys-prox (vsys3)

A) How do we get the configs to apply to the correct vsys on FW-Pair-1? I suspect because FW-Pair-2's vsys was never 'named' that luckily the configs went to the right vsys. In the Panorama template we tried manually typing in the vsys "Location: vsys-corp" and it auto-resets back to vsys1. Its either "none" or "vsys1". Beyond vsys1, what if we created another template to be assigned to vsys-proxy (vsys3), how would we assign a template to just that vsys?

B) How do we delete the "vsys1 (vsys6)" now that it was accidentally created?

Re: Assigning a template to a specific vsys within a Template Stack?

Remo — Sun, 09 Aug 2020 17:20:27 GMT

Hi @rolinger

A: In the templates you need to specify the name of the vsys and when you apply that template to a template stack and a firewall the configuration of that vsys is applied to the vsys with the same name on that firewall. If there is no vsys named like that, a new vsys will be created - as you have seen on fw-pair 1

B: delete the vsys in the template and commit and push the configuration to the firewall. After this step you can delete the vsys locally on the firewall to have panorama and the firewalls in sync again.

topic Re: Assigning a template to a specific vsys within a Template Stack? in General Topics

Assigning a template to a specific vsys within a Template Stack?

Re: Assigning a template to a specific vsys within a Template Stack?