New Panorama deployment - templates question

[ismailsh]

We have a new Panorama deployment.  We are deploying the first pair of PA440 HA pair.  The question I have is around templates and template stacks.  Do we create individual template-stack for each and every site that we will deploy Palo Alto firewalls in.  We will have a total of 100+ Palo Alto firewall all in HA mode.

My organization supports different customers at different sites.  Therefore no 2 sites will have the same Interface or same type of rules.

Want to know how everyone uses Panorama.  Whether they use it for all configurations deployment for site Palo Alto or just the common settings and then the more specific ones they do it directly on the Palo Alto itself.

[TomYoung · Accepted solution]

Hi @ismailsh ,

Thanks for asking.  The idea behind Panorama is that you can make a change once and push it to 100s of NGFWs.  You definitely want to put common items in templates and add those templates to each stack.  Same with device groups.

Beyond that, it is really your choice if you want to manage configuration from Panorama or locally.  There are pros and cons to each.  If you manage all config from Panorama, each NGFW will have its own template stack, except HA pairs will only have 1 template stack.  https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/manage-firewalls/transition-a-firewal...

You also have the choice to force template values from Panorama or override locally.  So, a NGFW could be have a template config, but the changes are still local.  It really depends how often you expect to make changes.

Device Groups are a little different.  When you follow the URL above, it deletes all local policy and object configuration.  Everything is managed from Panorama.  For those, I don't like doing anything local.  That's just my preference.  Beacon has a free class, Panorama 9.0: Manage Firewalls at Scale, that is excellent and highly recommended.

Thanks,

Tom