Re: Understanding on Panorama Templates

Reply
L2 Linker

Re: Understanding on Panorama Templates

In an event of failure of this stand alone deployed Panorama box (log collection and device management) from where will the firewall gets the the templates(Networ & device settings) information since I dont see this information in the local Firewall device config file.
is it ideal to manage the devices settings (HA, Admin roles, Authenction profiles,server profiles etc) via Panorama in a stand alone deployment or is it ideal to have them configured locally on the device.

In the same scenario as mentioned above how do we remove the override cog wheel on the local FW device if you decide to manage everthing from Panorama. one way i could think of is " force the template values" (only when there are like to like values on the Template and on the local device) is there any other way. 


Highlighted
L4 Transporter

@Sanssj 

 

It is generally safe to manage everything from Panorama and everything will work in case of Panorama failure.

 

The local firewall keeps the following configuration files:

“running-config” – this is local firewall configuration

“sp-config” -  holds config pushed from Panorama Devcie Groups for each vsys

“template-config” – this is config pushed from Panorama Templates

 

When you do config push from Panorama, the relevant firewall config files are updated, but then kept locally and nothing is lost if you lose connectivity to Panorama.

You can override template values locally on the firewall and I am not aware of a way to disable that. “Force template values” will force network and device tab config over the settings locally configured on the firewall, but will not prevent local admins to override the same values again after that.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!