02-04-2023 08:57 AM
Hi @ismailsh ,
Thanks for asking. The idea behind Panorama is that you can make a change once and push it to 100s of NGFWs. You definitely want to put common items in templates and add those templates to each stack. Same with device groups.
Beyond that, it is really your choice if you want to manage configuration from Panorama or locally. There are pros and cons to each. If you manage all config from Panorama, each NGFW will have its own template stack, except HA pairs will only have 1 template stack. https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/manage-firewalls/transition-a-firewal...
You also have the choice to force template values from Panorama or override locally. So, a NGFW could be have a template config, but the changes are still local. It really depends how often you expect to make changes.
Device Groups are a little different. When you follow the URL above, it deletes all local policy and object configuration. Everything is managed from Panorama. For those, I don't like doing anything local. That's just my preference. Beacon has a free class, Panorama 9.0: Manage Firewalls at Scale, that is excellent and highly recommended.
Thanks,
Tom
