4.2 Templates and Template Stacks Configuration

4.2 Templates and Template Stacks Configuration

Managing network interfaces, routing protocols, VPN tunnels, and system services across dozens or hundreds of firewalls requires a structured configuration framework. Panorama separates firewall configuration into two distinct domains: Device Groups (which handle security policies and objects) and Templates / Template Stacks (which handle network interfaces, zones, virtual routers, and system parameters).

---

Templates vs. Template Stacks

Understanding the distinction between an individual Template and a Template Stack is essential for designing scalable Panorama management architectures.

What is a Template?

A Template is an individual container for Network and Device configuration settings. A single template can define standard settings that apply across multiple firewalls. The configuration scopes covered by templates include:

• Network Tab Settings: Ethernet interfaces, aggregate ethernet (AE) groups, VLANs, loopback interfaces, security zones, virtual routers (OSPF, BGP, static routes), IPsec VPN tunnels, and GlobalProtect gateways/portals.
• Device Tab Settings: System setup (hostname, DNS servers, NTP servers, time zone), administrator user accounts, authentication profiles, SNMP configuration, syslog/email server profiles, and master key settings.

What is a Template Stack?

A Template Stack is an ordered sequence of individual templates combined together and assigned to specific target firewalls. Managed firewalls are assigned to a Template Stack, never directly to an isolated individual template. Key principles of template stacks include:

• Ordered Inheritance: Templates inside a stack are arranged in a strict top-to-bottom hierarchy.
• Top-Down Precedence: If the same configuration setting (e.g., a primary DNS server IP) is defined in multiple templates within the same stack, the value defined in the highest-positioned template in the stack overrides the values in lower templates.
• Direct Firewall Association: A firewall can belong to only one Template Stack at a time, but a single template can be included in multiple Template Stacks.

---

Hierarchy of Configuration Settings

When a firewall processes its active configuration, settings are evaluated in a clear order of precedence:

1. Local Firewall Configuration (Highest Precedence): Settings configured directly on the firewall local management web interface or CLI. Local settings override all template stack inherited values.
2. Template Stack Overrides: Variable overrides or stack-level modifications configured in Panorama at the Template Stack level.
3. Top Template in Stack: Settings defined in the top-most template within the assigned stack.
4. Subsequent Templates in Stack (Top to Bottom): Settings inherited from lower templates in the stack.
5. Bottom Template in Stack (Lowest Precedence): Baseline or global settings defined in the bottom-most template (e.g., global NTP or DNS parameters).

[ Local Firewall Config ]  -->  Overrides Template Stack
       |
[ Template Stack Overrides / Variables ]
       |
[ Template 1 (Top) ]       -->  Overrides Template 2 & 3
       |
[ Template 2 (Middle) ]    -->  Overrides Template 3
       |
[ Template 3 (Bottom) ]    -->  Global Baseline Settings

---

Template Variables and Dynamic Parameterization

In multi-site deployments, firewalls share common networking structures (such as static route frameworks, BGP configurations, or zone definitions) but require unique, site-specific parameters (such as WAN interface IP addresses, peer AS numbers, or local gateway IPs). Panorama resolves this through Template Variables.

Variable Definition and Types

Variables are created inside a template or template stack using a dollar sign prefix (e.g., $WAN_IP, $NEXT_HOP_GW, $BGP_LOCAL_AS). Supported variable types include:

• IP Address / Subnet: Used for interface IP addresses, static route next-hops, and server IPs.
• Interface Name: Used to dynamically assign physical interface identifiers (e.g., ethernet1/1 vs ethernet1/5).
• Autonomous System (AS) Number: Used in BGP routing protocol definitions.
• Text String: Used for hostnames, domain names, or profile identifiers.
• Egress Interface: Used in routing and NAT definitions.

Example Variable Syntax:
Interface IP: $FW_WAN_IP / 30
Next-Hop Gateway: $WAN_GATEWAY_IP
BGP Local AS: $SITE_BGP_AS

Overriding Variables Per Managed Device

Administrators assign default variable values at the Template or Template Stack level. To customize parameters for an individual firewall, the administrator selects the specific device under Panorama > Templates > Stack > Variable Overrides and supplies device-specific values. When Panorama pushes the stack to that firewall, it substitutes the template variables with the device-specific values, achieving customized local configuration without duplicating templates.

---

Managing Local Overrides and Inherited Values

When a template stack is pushed to a firewall, the firewall GUI visually distinguishes between template-inherited settings and local settings:

• Inherited Values (Green Text / Template Icon): Indicate settings pushed from a Panorama Template Stack. These fields are read-only on the firewall unless explicitly overridden.
• Local Overrides (Red/Yellow Background or Override Indicator): Indicate settings that were modified locally on the firewall or overridden via local CLI/GUI actions.

Reverting Local Overrides

Local overrides can introduce configuration drift and defeat centralized management. Administrators can revert local overrides back to template-inherited values using two methods:

1. Revert Button on Firewall: On the firewall GUI, select the overridden field and click Revert to discard local changes and restore the template stack value.
2. Force Template Values During Push: During a Panorama Push to Devices operation, check the Force Template Values option. This forcefully overwrites all local network and device settings on the target firewalls with the exact values defined in the Panorama Template Stack.

---

Multi-Tenant and Enterprise Template Architecture

Best-practice enterprise design utilizes a layered, modular template stack structure:

• Base System Template (Bottom of Stack): Contains universal corporate settings such as DNS servers, NTP servers, SNMP community strings, syslog server profiles, and admin authentication settings.
• Regional Template (Middle of Stack): Contains region-specific routing rules, time zones, regional syslog collectors, and shared IPsec VPN profiles.
• Site-Specific / Model-Specific Template (Top of Stack): Contains hardware-specific interface mappings (e.g., PA-3410 vs PA-5450 port layouts) and site-unique variables.

---

Templates vs. Template Stacks Comparison