cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Who rated this post

Cyber Elite
Cyber Elite

Hello @Sujanya

 

I can only speak for my own experience. Although, it is possible to completely manage a Firewall HA pair from Panorama including HA config in a single template stack by leveraging variables:

https://knowledgebase.paloaltonetworks.com/kcsArticleDetail?id=kA10g000000PNG0

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POI2CAO

 

I personally found it easier and less error prone to setup a basic config like management interface and built HA first, then add the Firewall pair to Panorama and push the rest of the configuration. I have not found any document/design guide that would state would the best practice would be in this scenario, however since HA setting is mostly one time setup that we do not modify frequently, I decided to keep HA as an exception and manage it locally on Firewall instead of pushing it by Panorama. As of now we have 150+ Firewalls and I have not felt that this strategy needs to change.

If you add a Firewall pair to Panorama and later decide to let Panorama to manager HA, then you can always push HA configuration from Panorama Template and override it locally without using Force Template Values.

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.
Who rated this post