04-11-2023 09:40 AM
When we started using the Panorama many years ago, we did so using the templates as an after thought of manually configuring each firewall. We are a small company so it wasn't difficult, but now we want to entertain SD WAN and my understanding is it is best to do this from the Panorama and not individually from each firewall.
Since the Interfaces/Zones are set up individually, but identically (other than IP address differences) what would happen if I introduced the Interface/Zone configurations to the Panorama and then pushed this down to the firewall(s)? Scared to do so and cause issues. What is the best way forward? Maybe set up a new template with this configured and then move each firewall to the new template.
I should add I have 11 firewalls. The majority of these are in one template (9 firewalls) with 1 other in its own template and the last firewall is manually maintained and is different from all the rest.
04-11-2023 11:49 AM
Hey @ronan , from the brief description of your network, panos native SDWAN in Panorama will work well without knowing your full checklist of needs. To handle the device-group parent-child relationships for pre and post rules, I recommend this document - Manage Your Device Group Configurations on Panorama (paloaltonetworks.com) and make sure you configure a Master Device, & Reference Template. You can store objects in a Parent DG instead of shared to keep from overloading smaller firewalls but there is a checkbox in Panorama to only download objects used by the firewall. Since your zone name characters/case are identical, you should be able to share much of your policy via parent DG.
For Templates/Template-Stacks, you will use variables to identify different IP addresses & FQDNs for different firewalls using the same Template-Stacks.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!