Palo Alto Networks Knowledgebase: How to duplicate settings among multiple templates
How to duplicate settings among multiple templates
Created On 02/07/19 23:55 PM - Last Updated 02/07/19 23:55 PM
Cortex Data Lake
At times you may want to duplicate/reconfigure Network or Device tab settings for multiple templates. For example, if you have N number of templates but want to share the same Administrator accounts, LDAP servers, etc among all of them you can duplicate or reconfigure settings.
There are two options to do so, besides the GUI option of configuring everything manually.
Duplicate configuration between templates on the CLI using set commands or load configuration partial.
Use template stacks to combine common elements. This option is only available if you are running PAN-OS 7.0+.
Method 1: Duplicate configuration between templates using set commands from the CLI:
Go to configuration mode on the Panorama CLI, and set the configuration output mode to set:
admin@Panorama# run set cli config-output-format set
Find the configuration that you want to copy. For example:
admin@Panorama# show | match Template1
set template Template1 settings operational-mode normal
set template Template1 config devices localhost.localdomain vsys vsys1
set template Template1 config mgt-config users Admin3 phash $1$sykssmec$kst3ufkcj9.Htg9zAXvDy0
Copy the required configuration on a notepad, in this all configuration under mgt-config and edit the template name to target template. Then copy and paste the same back on the CLI after enabling scripting-mode:
Notice the path used in from-xpath, which doesn't include /config/ in the beginning since /config/ indicates the current device configuration. Also, notice the changed template name (target template) in the to-xpath.
Method 3: Use template stacks (When running PAN-OS 7.0.X only)
Create a Common Template, TemplateCommon for example. Do not assign any devices to this template. Configure admin accounts to be shared on this template.
Create a Template Stack called TemplateStack1, and add two templates to it: TemplateCommon and Template1, in that order.
Unassign Firewall1 from Template1 and assign it to TemplateStack1.
Similarly, create a Template Stack called as TemplateStack2, and add two templates to it: TemplateCommon and Template2, in that order.
Unassign Firewall2 from Template2 and assign it to TemplateStack2.
Commit the changes locally to Panorama, and perform a Template commit to Firewall1 and Firewall2.
Check the GUI of both firewalls to make sure admin accounts are pushed properly.
In the future, any common changes can be just made in TemplateCommon, and then pushed to all devices by doing a commit on the corresponding Template Stack.