Panorama Template/Template-Stack Variables Override

cancel
Showing results for 
Search instead for 
Did you mean: 

Panorama Template/Template-Stack Variables Override

L3 Networker

Is it best practice to override template variable settings at the template-stack or at the device level? It looks like template stack would be sufficient unless you have multiple firewalls and only a select number with different settings.

PCNSC, PCNSE
1 ACCEPTED SOLUTION

Accepted Solutions

L6 Presenter

Hi @Gene_Barden 

 

Yes you’re correct! This setting is required depending upon the use cases. Lets say, you have bunch of firewalls and you want to keep some firewall specific configurations that shouldn’t get applied to other firewalls or the configuration needs to be modified locally on firewall, you can use this option.

So with this, you can manage the base configurations from Panorama through templates and the overridden configuration locally on the firewall. This local configuration would be specific to that firewall only.

Now if you do not have as such use case then you can keep all configuration pushed from Panorama itself. In case, you have such use case/requirement and if you override the configuration, that is also okay. Everything should be fine. So as per my understanding, these are the options that we can apply depending upon our use cases, there’s nothing like best practice for this.

Only thing is, overridden configuration wont have any effect of every template pushed. You have to manage that particular configuration locally on firewall.

 

Hope it helps!

 

Mayur S.

View solution in original post

1 REPLY 1

L6 Presenter

Hi @Gene_Barden 

 

Yes you’re correct! This setting is required depending upon the use cases. Lets say, you have bunch of firewalls and you want to keep some firewall specific configurations that shouldn’t get applied to other firewalls or the configuration needs to be modified locally on firewall, you can use this option.

So with this, you can manage the base configurations from Panorama through templates and the overridden configuration locally on the firewall. This local configuration would be specific to that firewall only.

Now if you do not have as such use case then you can keep all configuration pushed from Panorama itself. In case, you have such use case/requirement and if you override the configuration, that is also okay. Everything should be fine. So as per my understanding, these are the options that we can apply depending upon our use cases, there’s nothing like best practice for this.

Only thing is, overridden configuration wont have any effect of every template pushed. You have to manage that particular configuration locally on firewall.

 

Hope it helps!

 

Mayur S.

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!