Configure existing Production Panorama template used for Policies/Objects, but not Interfaces/Zones for SD WAN

[ronan]

When we started using the Panorama many years ago, we did so using the templates as an after thought of manually configuring each firewall. We are a small company so it wasn't difficult, but now we want to entertain SD WAN and my understanding is it is best to do this from the Panorama and not individually from each firewall. 

Since the Interfaces/Zones are set up individually, but identically (other than IP address differences) what would happen if I introduced the Interface/Zone configurations to the Panorama and then pushed this down to the firewall(s)? Scared to do so and cause issues. What is the best way forward? Maybe set up a new template with this configured and then move each firewall to the new template. 

I should add I have 11 firewalls. The majority of these are in one template (9 firewalls) with 1 other in its own template and the last firewall is manually maintained and is different from all the rest. 

[delliott_6784]

Hey @ronan , from the brief description of your network, panos native SDWAN in Panorama will work well without knowing your full checklist of needs. To handle the device-group parent-child relationships for pre and post rules, I recommend this document - Manage Your Device Group Configurations on Panorama (paloaltonetworks.com) and make sure you configure a Master Device, & Reference Template.  You can store objects in a Parent DG instead of shared to keep from overloading smaller firewalls but there is a checkbox in Panorama to only download objects used by the firewall.  Since your zone name characters/case are identical, you should be able to share much of your policy via parent DG. 

For Templates/Template-Stacks, you will use variables to identify different IP addresses & FQDNs for different firewalls using the same Template-Stacks.