Managing HA Settings of firewall locally instead of managing it from Panorama

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Managing HA Settings of firewall locally instead of managing it from Panorama

L3 Networker

Hi Folks,


We had recently migrated HA firewall to Panorama using the below documentation 


Migrate a Firewall HA Pair to Panorama Management:
As per below documentation once the migration had been completed the HA settings and management IP address of the HA firewall need to be managed locally on the firewall by over-riding the template values.
Also both the HA firewalls are in same template group which indicates that we will not be able to manage the firewall.
But the customer is not OK with it and need to manage HA settings and everything from Panorama itself.
We are thinking about creating an common template containing all the required changes for both the firewalls and create two template stack for each firewall and call the template in those template stacks.
Then create two separate template dedicated for HA Settings, Management IP address configuration and other things which will be different from both the firewalls and map primary firewall HA temp config to Primary firewall stack and do the same for Secondary firewall temp and map it to secondary firewall also.
Please let me know if this approach is correct.
Temp 1 == all common settings, temp 2= Primary HA Settings, Temp 3 = Sec HA Settings\\\ Temp stack 1(Primary FW)== temp1, temp 2. \\\temp stack 2(Secondary FW) = temp1, temp 3
Thanks in advance

Cyber Elite
Cyber Elite

Thank you for the post @tamilvanan


First of all, I agree with you that it is better and safer to managed HA locally instead of using Panorama. Overall, your design of Templates/Template Stack looks good and to me it looks functional. The only thing I am worried about is pushing of setting from Template (HA setting, interfaces,..) will not be applied if Firewall has already existing overlapping configuration. You will have to override it locally to apply Panorama pushed configuration: Alternative approach is to select: "Force Template Values" while pushing configuration, but this involves risk that local config that is not included in Template will be wiped, so I would go with overriding it locally as this is only one time job.


Could you please post back how well this went? I am wondering how smooth it was.


Kind Regards


Help the community: Like helpful comments and mark solutions.

Whatever you have mentioned had worked well in my case. I had overridden local settings on firewall first. Just sharing my experience. Thank you 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!