Panorama > Templates

Through the Device and Network tabs, templates enable you to deploy a common base configuration to multiple firewalls that require similar settings. A template stack is a combination of templates. When managing firewall configurations with Panorama, you use a combination of device groups (to manage shared policies and objects) and templates (to manage shared device and network settings).

In addition to the fields displayed in the dialogs for creating Templates or Template Stacks, the Panorama > Templates page displays the following columns:

Type—Identifies the listed entries as templates or template stacks. Stack—Lists the templates assigned to a template stack.

The following topics provide additional information about templates and template stacks.

What do you want to do?	See:
Add, clone, edit, or delete a template	Templates
Add, clone, edit, or delete a template stack	Template Stacks
Looking for more?	Templates and Template Stacks
Looking for more?	Manage Templates and Template Stacks

Templates

To configure a template, click Add and complete the following fields.

After configuring a template, you must Commit Your Changes in Panorama. After you configure the network and device settings of firewalls assigned to the template

, you must perform a template commit to push the settings to the firewalls.

Deleting a template, or removing a firewall from one, does not delete the values that Panorama has pushed to the firewall. When you remove a firewall from a template, Panorama no longer pushes new updates to the firewall.

Template Setting	Description
Name	Enter a template name (up to 31 characters). Use only letters, numbers, spaces, hyphens, periods, and underscores. The name is case-sensitive and must be unique. In the Device and Network tabs, this name will appear in the Template drop-down. The settings you modify in these tabs apply only to the selected Template.
Default VSYS	Select a virtual system if you want Panorama to push configurations that are specific to that virtual system (for example, interfaces) to firewalls that don’t have multiple virtual systems.
Description	Enter a description for the template.
Devices	Select each firewall that you want to add to the template. You can assign a given firewall to only one template or stack. Therefore, if you will use the template only within a stack, do not assign firewalls to the template, just to the stack (see Template Stacks s). If the list of firewalls is long, you can filter it by Platforms, Device Groups, Tags, and HA Status. For each of these categories, the dialog displays the number of managed firewalls. You can assign firewalls that have non-matching modes (VPN mode, multiple virtual systems mode, or operational mode) to the same template. Panorama pushes mode-specific settings only to firewalls that support those modes.
Select All	Selects every firewall in the list.
Deselect All	Deselects every firewall in the list.
Group HA Peers	Select this option to group firewalls that are high availability (HA) peers. The list then displays the active firewall (or active-primary firewall in an active/active configuration) first and displays the passive firewall (or active-secondary firewall in an active/active configuration) in parentheses. This option enables you to easily identify firewalls that have an HA configuration and, when pushing template settings, you can push to the grouped pair instead of to each firewall individually.
Filter Selected	To display only specific firewalls, select the firewalls and then Filter Selected.

Template Stacks

A template stack is a combination of templates. By assigning firewalls to a stack, you can push all the necessary settings to them without the redundancy of adding every setting to every template. Panorama supports up to 128 stacks. To configure a template stack, click Add Stack and complete the following fields.

After configuring a template stack, you must Commit Your Changes in Panorama. After you configure the network and device settings of firewalls assigned to the stack

, you must perform a template commit to push the settings to the firewalls.

Deleting a template stack, or removing a firewall from one, does not delete the values that Panorama has pushed to the firewall. When you remove a firewall from a template stack, Panorama no longer pushes new updates to the firewall.

Template Stack Setting	Description
Name	Enter a stack name (up to 31 characters). Use only letters, numbers, and underscores. The initial character must be a letter. The name is case-sensitive and must be unique. In the Device and Network tabs, the Template drop-down will display the stack name and its assigned templates.
Description	Enter a description for the stack.
Templates	For each template you want to include in the stack (up to 16), click Add and select the template. If templates have duplicate settings, Panorama pushes only the settings of the higher template in the list to the assigned firewalls. For example, if Template_A is above Template_B in the list, and both templates define the ethernet1/1 interface, Panorama pushes the ethernet1/1 definition from Template_A and not from Template_B. To change the order, select a template and click Move Up or Move Down. Panorama doesn’t validate template combinations in stacks, so plan the order in a way that avoids invalid relationships.
Devices	Select each firewall that you want to add to the stack. If the list of firewalls is long, you can filter it by Platforms, Device Groups, Tags, and HA Status. You can assign firewalls that have non-matching modes (VPN mode, multiple virtual systems mode, or operational mode) to the same stack. Panorama pushes mode-specific settings only to firewalls that support those modes.
Select All	Selects every firewall in the list.
Deselect All	Deselects every firewall in the list.
Group HA Peers	Select this option to group firewalls that are high availability (HA) peers. This option enables you to easily identify firewalls that have an HA configuration. When pushing settings from the template stack, you can push to the grouped pair instead of to each firewall individually.
Filter Selected	To display only specific firewalls, select the firewalls and then Filter Selected.

Document:PAN-OS® Web Interface Reference Guide

Panorama > Templates

Related Documentation

Document:PAN-OS® Web Interface Reference Guide

Panorama > Templates

Related Documentation

Configure a Template Stack

Templates and Template Stacks

Add a Template

Commit Your Changes in Panorama

Manage Templates and Template Stacks

Override a Template Setting

Disable/Remove Template Settings

Create Template(s), and Device Group(s) on Panorama

Support for Device Group Hierarchy in the VM-Series NSX edition firewall

Manage Firewalls