I am trying to create a configuration template which I can change certain variables and pushed the config to multiple firewalls.
However PAN is not behaving the way I need. I have two problems which seems to be related to PAN's design.
1) Even if you fetch the config in set mode and pasted in back in CLI due to strict reference check it fails to run.
2) Because of this problem, I base my template of XML config then I import it on the new firewalls however XML is quite
dependent on PAN-OS version so my config generated from template might fail to load on 9.0 version in the future. With set based,
it is easier for me to fix the errors but XML is harder.
I wonder what other people do (except recommending panorama as we use it for most but for certain config panorama isn't really efficient) to create a golden template.
Because of this strict check on CLI, I have to defer to XML but it has its own challenges.
Looks like you might want to check out Iron Skillet. I created my own base template off of it and just do a search and replace in the xml.
To add onto the IronSkillet approach that @OtakarKlier brought up. Generally the pieces of the configuration that most people actually care about templating aren't actually dependent on PAN-OS release. So you could make generic XML templates for the major versions, and then further pull in the rulebase and objects and such.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!