08-12-2022 05:06 PM
Hello @Sujanya
I can only speak for my own experience. Although, it is possible to completely manage a Firewall HA pair from Panorama including HA config in a single template stack by leveraging variables:
https://knowledgebase.paloaltonetworks.com/kcsArticleDetail?id=kA10g000000PNG0
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POI2CAO
I personally found it easier and less error prone to setup a basic config like management interface and built HA first, then add the Firewall pair to Panorama and push the rest of the configuration. I have not found any document/design guide that would state would the best practice would be in this scenario, however since HA setting is mostly one time setup that we do not modify frequently, I decided to keep HA as an exception and manage it locally on Firewall instead of pushing it by Panorama. As of now we have 150+ Firewalls and I have not felt that this strategy needs to change.
If you add a Firewall pair to Panorama and later decide to let Panorama to manager HA, then you can always push HA configuration from Panorama Template and override it locally without using Force Template Values.
Kind Regards
Pavel
