Create Template Stacks and Device Groups on Panorama
To manage the VM-Series firewalls on NSX-T
using Panorama, the firewalls must belong to a device group and
a template stack. Device groups allow you to assemble firewalls
that need similar policies and objects as a logical unit; the configuration
is defined using the
Objects
and Policies
tabs
on Panorama. Use template stacks to configure the settings that
are required for the VM-Series firewalls to operate on the network;
the configuration is defined using the Device
and Network
tabs
on Panorama. Each template stack used in your NSX-T configuration
must be associated with a service definition.Firewalls deployed
in NSX-T have two default zones and two interfaces configured in virtual-wire
mode. Ethernet1/1 is part of zone
south
and
ethernet1/2 is part of zone north
. To push
policy rules from Panorama to managed firewalls, you must configure zones
and interfaces matching those on the firewall in the corresponding
template stack on Panorama.- Add a device group or a device group hierarchy.
- Enter a uniqueNameand aDescriptionto identify the device group.
- ClickOK.
- ClickCommitand selectPanoramaas theCommit Typeto save the changes to the running configuration on Panorama.
- Add a template.
- Select, and clickPanoramaTemplatesAdd.
- Enter a uniqueNameand aDescriptionto identify the template.
- ClickOK.
- ClickCommit, and selectPanoramaas theCommit Typeto save the changes to the running configuration on Panorama.
- Create a template stack.
- Select, and clickPanoramaTemplatesAdd Stack.
- Enter a uniqueNameand aDescriptionto identify the template.
- ClickAddto add the template you created previously.
- ClickOK.
- ClickCommit, and selectCommit to Panoramato save the changes to the running configuration on Panorama.
- Configure the virtual wire, interfaces, and zones. Ensure that you select the correct template from the drop-down shown below. The objects you create must meet the following criteria:If you change the default virtual wire or zone names, the virtual wire and zones on Panorama must match the names used on the firewall.
- Useethernet1/1andethernet1/2.
- The virtual wire object namedvw1.
- The first zone namedsouth, typevirtual-wire, and containethernet1/1.
- The second zone namednorth, typevirtual-wire, and containethernet1/2.
Repeat this process for each template in your deployment. - ClickCommit, and selectPanoramaas theCommit Typeto save the changes to the running configuration on Panorama.
Recommended For You
Recommended Videos
Recommended videos not found.