Panorama Template Overridden objects

[batd2]

Do you know where in CLI or configuration files we can find Panorama Template objects which were locally overridden on a firewall? I am trying to script for locally overridden configuration settings checks of  multiple Panorama-managed firewalls, but noting in the configuration files indicates that the object was overridden.

Do you have more inside understanding of how the override process works and how is it processed by the firewall?  

[batd2]

Can anyone suggest a solution? 

[MattGowland]

Did you ever find a solution to this?

[cchaffee]

I would like to know this as well.  I keep running into issues where a pano config isn't applied consistently because someone has intentionally or unintentionally overridden it locally on the device.

[SimonT]

same here. Is this information available?

[PavelK]

Hello Everyone,

during one of the pre-Covid Ignite, I have asked the same question PAN engineer during one of the session. The answer was there is no way to detect from Panorama side locally overriden configuration. The only advice he could give me, was to enable email alert for configuration changes on local Firewall.

Kind Regards

Pavel

[aortiz]

The command show config pushed-template vs show config running or show config merged for comparisons. That’s what I would suggest.