Panorama template push on production devices

[ericv]

I have an environment where there are Palo Alto firewalls already deployed and in production (mix of PA-200's & PA-500's), I am building the templates but I want to make sure that when I push them out the templates won't wipe out the management interface settings or settings that are left blank in the template on Panorama. I have looked through documentation and forum searches but it all points to new devices where on the first template push the device can be overwritten. I also know of the option "force template values" and I suspect if this is checked off the management ip address won't get wiped and the existing security zones will stay there but I am hesitant to push this out before being 100% as if it wipes the zones I will lose remote access.

I am assuming someone has run into this before.

[kadak · Accepted solution]

Hello Eric,

You are right. If you push a network template without checking 'Forced Template Values'', panorama will merge it configuration with the firewall's candidate/running configuration.

If 'Forced Template Values' option is checked along with 'Merge with Device Candidate Configuration', panorama will try to override all the configuration on the firewall with the template's configuration which would be catastrophic. If your firewall contains some local configuration , it is always a good practice to NOT check that 'Forced Template Values' option while committing.

Hope that helps!

Regards,

Kunal Adak

[ericv]

Thanks for the quick response, to confirm any setting which is not configured in the template will not over-ride what is on the Palo Alto firewall as long as the "force template value" check box is unchecked

[mschuricht]

Eric,

If a setting is not configured in a template, then the template is not going to affect local device config regardless of checking/unchecking "Force Template Values". The force will only remove local device configuration for settings which are configured in a template and overlap.

Mike

[netcomsupp]

try it ofirst on one member if you have HA

i have also seen on version 6 that if the Interface is configured on local device and not MGMT profile and on the template in panorama you have configured the MGMT profile then when commiting with merge configuration option the local device will show in green + yellow icon meaning the local device values overrides template values and the MGMT Profile from panorama wont take effect, that makes me think what is the "scope" of the merge configuration and how really the template can be template for managing many devices