topic Re: Panorama - deleting part of a template? in General Topics

Panorama - deleting part of a template?

JimMcGrady — Mon, 07 Sep 2020 06:57:56 GMT

When i import my HA pair of firewalls into Panorama (9.1.3), the resulting template includes values for HA config. I would like to leave HA config up to the gateways themselves and not include it as part of the template. How would i delete that part of the template? If i set values to their defaults, that part of the config still exists in the template as default values. I want to remove it.

Re: Panorama - deleting part of a template?

mb_equate — Mon, 07 Sep 2020 08:15:17 GMT

Something PANW don't explain very well - setting a value to the default in a template doesn't necessarily remove it from the template, it simply sets the value to what you've told it. Most template settings allow you to 'clear' a value by hitting the green X (it indicates you have intentionally set a value and allows you to clear it to 'default'). For on/off settings they basically have 3 states - on, off or not configured. So just clear the values in the template and make sure they are set on the managed device.

If the managed device is already using template values (i.e. you hit "force template values" and the settings are depicted by a green cog on the device itself), you need to add local overrides with your intended values before you clear them from the template, otherwise you may lose the configuration. Ensure they are either configured locally (no green cog) or locally overridden (yellow over green cog) before you remove the template values.

I think this should be the default approach for both HA and management - that way you can share a template across an HA cluster without variables.

Re: Panorama - deleting part of a template?

JimMcGrady — Mon, 07 Sep 2020 09:48:55 GMT

Thanks for that. I see i can click on the 'green cog' next to a setting in a Panorama template. This makes the green cog disappear - which means Panorama wont push a value for that particular field.