Panorama Template/Template-Stack Variables Override

[Gene_Barden]

Is it best practice to override template variable settings at the template-stack or at the device level? It looks like template stack would be sufficient unless you have multiple firewalls and only a select number with different settings.

[SutareMayur · Accepted solution]

Hi @Gene_Barden 

Yes you’re correct! This setting is required depending upon the use cases. Lets say, you have bunch of firewalls and you want to keep some firewall specific configurations that shouldn’t get applied to other firewalls or the configuration needs to be modified locally on firewall, you can use this option.

So with this, you can manage the base configurations from Panorama through templates and the overridden configuration locally on the firewall. This local configuration would be specific to that firewall only.

Now if you do not have as such use case then you can keep all configuration pushed from Panorama itself. In case, you have such use case/requirement and if you override the configuration, that is also okay. Everything should be fine. So as per my understanding, these are the options that we can apply depending upon our use cases, there’s nothing like best practice for this.

Only thing is, overridden configuration wont have any effect of every template pushed. You have to manage that particular configuration locally on firewall.

Hope it helps!