Configure existing Production Panorama template used for Policies/Objects, but not Interfaces/Zones for SD WAN

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Configure existing Production Panorama template used for Policies/Objects, but not Interfaces/Zones for SD WAN

L0 Member

When we started using the Panorama many years ago, we did so using the templates as an after thought of manually configuring each firewall. We are a small company so it wasn't difficult, but now we want to entertain SD WAN and my understanding is it is best to do this from the Panorama and not individually from each firewall. 


Since the Interfaces/Zones are set up individually, but identically (other than IP address differences) what would happen if I introduced the Interface/Zone configurations to the Panorama and then pushed this down to the firewall(s)? Scared to do so and cause issues. What is the best way forward? Maybe set up a new template with this configured and then move each firewall to the new template. 


I should add I have 11 firewalls. The majority of these are in one template (9 firewalls) with 1 other in its own template and the last firewall is manually maintained and is different from all the rest. 


L2 Linker

Hey @ronan , from the brief description of your network, panos native SDWAN in Panorama will work well without knowing your full checklist of needs. To handle the device-group parent-child relationships for pre and post rules, I recommend this document - Manage Your Device Group Configurations on Panorama ( and make sure you configure a Master Device, & Reference Template.  You can store objects in a Parent DG instead of shared to keep from overloading smaller firewalls but there is a checkbox in Panorama to only download objects used by the firewall.  Since your zone name characters/case are identical, you should be able to share much of your policy via parent DG. 


For Templates/Template-Stacks, you will use variables to identify different IP addresses & FQDNs for different firewalls using the same Template-Stacks.   

Douglas Elliott
Security Implementation Engineer
  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!