PAN-OS: Panorama Templates and Template Stacks

PCNSE Objective Focus (Domain 4 - 18%)

4.1 Configure Firewall Management

Introduction: Centralized Configuration Management

Panorama™ provides centralized management for multiple Palo Alto Networks firewalls. Two core components enabling efficient and consistent configuration across managed devices are Templates and Template Stacks .

Using Templates and Stacks dramatically simplifies administration, ensures consistency, reduces errors, and allows for scalable deployment and modification of firewall settings across an organization.

This guide focuses specifically on identifying the types of configurations managed within Templates, aligning with PCNSE objective 4.1.1.

Panorama Configuration Hierarchy

Understanding where Templates fit into the overall Panorama configuration hierarchy is crucial: 

graph TD
    A["Shared Settings (Global Objects/Policies - Optional)"] --> B["Device Group - Pre Rules Policies & Objects"];
    B --> C{"Template Stack Applied to Device Group"};
    C --> T1["Template 1 (Network/Device Settings)"];
    T1 --> T2["Template 2 (Network/Device Settings)"];
    T2 --> D["Device Group - Post Rules Policies & Objects"];
    D --> E["Local Firewall Config Overrides where allowed"];

    subgraph Legend
        direction LR
        L1["Panorama Config"] --> L2["Firewall Specific Config"]
    end

    style C fill:#eaf2f8,stroke:#aed6f1,stroke-width:2px
    style T1 fill:#fdebd0,stroke:#f5b041,stroke-width:1px
    style T2 fill:#fdebd0,stroke:#f5b041,stroke-width:1px
Simplified Panorama Configuration Hierarchy. Settings are merged, with lower levels typically overriding higher levels if conflicts exist.

Settings pushed from Panorama (Device Groups, Templates/Stacks) generally override local firewall configurations unless specifically configured otherwise (rare). Within a Template Stack, settings in later templates override settings for the same item in earlier templates.

Components Configured in a Template (PCNSE 4.1.1 Focus)

Templates in Panorama are specifically designed to manage configurations found under the Network and Device tabs of a firewall's local configuration. They do *not* manage policies or most objects.

Network Tab Components (Examples):

Templates allow you to configure settings related to network connectivity and infrastructure:

Device Tab Components (Examples):

Templates manage device-specific operational settings:

What is NOT Configured in Templates

It's equally important to know what is NOT managed by Templates. These configurations belong primarily in Panorama Device Groups (or potentially Shared):

Think of Templates for the firewall's underlying network and device setup, and Device Groups for the security policies and the objects those policies reference.

Panorama Templates Quiz (PCNSE 4.1.1 Focus)

1. What is the primary purpose of a Template in Panorama?

Templates are specifically used to manage configurations found under the Network and Device tabs of a firewall, promoting consistency for infrastructure settings across multiple devices.

2. Which PAN-OS configuration tab's settings are primarily managed using Panorama Templates? (Select TWO)

Templates contain configuration settings that correspond directly to the Network and Device tabs found in the firewall's local GUI or Panorama's template configuration area. Policies and most Objects are managed via Device Groups.

3. Which of the following components is typically configured within a Panorama Template?

Interface Management Profiles are configured under Network > Network Profiles within a Template. Security Policies, Address Objects, and Antivirus Profiles are configured within Device Groups (or Shared).

4. Which of the following components is typically NOT configured within a Panorama Template?

NAT Policy rules, like Security, QoS, and Decryption policies, are configured within Device Groups (Pre/Post Rules) or potentially Shared scope, not within Templates.

5. How are multiple Templates applied to a group of firewalls in a specific order?

Template Stacks are used to group multiple Templates together in a specific, ordered sequence. The Stack is then assigned to a Device Group, applying the combined configurations in that order.

6. Where would you configure GlobalProtect Portal settings that need to be consistent across multiple branch firewalls?

GlobalProtect Portal configurations (interfaces, authentication, agent settings, etc.) are part of the Network configuration and are therefore managed within Panorama Templates for consistency.

7. Which setting IS configurable within a Template?

Service Route configuration is found under the Device tab settings within Panorama Templates. Policies and most Objects (Addresses, Services, URL Categories, Security Profiles) are configured in Device Groups.

8. True or False: Static Routes for a specific Virtual Router can be configured within a Panorama Template.

True. While routing *protocols* might have separate policies, basic static routes are configured directly within the Virtual Router settings under the Network tab of a Template.

9. If a setting (e.g., DNS server IP) is defined in Template A and differently in Template B, and both are in a Template Stack applied to a Device Group with Template B listed *after* Template A, which setting takes effect on the firewall?

Within a Template Stack, templates are processed in order. Settings in later templates override identical settings from earlier templates in the same stack.

10. Which component would you use in Panorama to define an Antivirus Security Profile that needs to be applied via Security Policies to multiple firewalls?

Security Profiles (like Antivirus) are considered Objects that are applied by Policies. Therefore, they are configured within the appropriate Device Group (or potentially in the Shared scope if applicable to all device groups) and referenced by Security Policy rules within that Device Group. They are not configured in Templates.