cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Who rated this post

L1 Bithead

A very simple and yet practical example of this limitation and a workaround is with Interface Management Profiles.

 

Say I have three templates (I prefix my templates with "T-")

 

  • T-ACME-Baseline
  • T-ACME-User
  • T-ACME-Datacenter

 

From those three templates I build two template stacks (note that template stacks cannot have hyphens in their names, I use "TS_") and their constituent templates.

 

TS_ACME_User

  • T-ACME-User
  • T-ACME-Baseline

 

TS_ACME_Datacenter

  • T-ACME-Datacenter
  • T-ACME-Baseline

 

2018-05-16 21_59_57-Window.png

 

The "User" TS is assigned to the ficticious "User" firewall and the "Datacenter" TS to the fictitious "Datacenter" firewall.

 

Build an Interface Management Profile called "Ping-Only" in T-ACME-Baseline (which is a constituent T of both TS's). Build the Interface configuration in T-ACME-User and T-ACME-Datacenter.

 

From T-ACME-User and T-ACME-Datacenter this "Ping-Only" Interface Management Profile is not visible when building the Interfaces within these templates. However, from the Template Stacks themselves (TS_ACME_User and TS_ACME_Datacenter) "Ping-Only" is visible and can be applied.

 

When opening up an Interface from the Template Stack itself, the "Ping-Only" profile is present, but Panorama says the entire dialog box is Read Only and won't permit clicking OK. See screenshot below.

 

2018-05-16 22_26_31-Window.png

 

Lucky for us we can Override (note the Panorama Template selected is still the Template Stack).

 

2018-05-16 22_30_55-Window.png

 

After selecting Override the dialog box is no longer Read Only, "Ping-Only" profile is still visible, select it, click OK, Commit and Push.

 

Since the Override is within Panorama (and not a local firewall change), it will be unaffected by a "Force Template Values" push (good).

 

With that we are able to build a "Ping-Only" Interface Management Profile in a "Baseline" T, build our Interfaces in other T's, then apply the "Ping-Only" profile in the TS.

 

I have not tried the specific examples you mentioned in the post.

 

In summary, referencing a specific template's constructions directly in another template is not possible. However, constructions from a specific template can be combined with another specific template and actually applied using the Override function within the Template Stack.

Who rated this post