12
•
Panorama
6.1
Administrator’s
Guide
©
Palo
Alto
Networks,
Inc.
Centralized
Configuration
and
Deployment
Management
Panorama
Overview
Centralized
Configuration
and
Deployment
Management
Panorama
uses
Device
Groups
and
Templates
to
group
devices
into
smaller
and
more
logical
sets
that
require
similar
configuration.
All
configuration
elements,
policies,
and
objects
on
the
managed
firewalls
can
be
centrally
managed
on
Panorama
using
Device
Groups
and
Templates.
In
addition
to
managing
configuration
and
policies,
Panorama
enables
you
to
centrally
manage
licenses,
software
and
associated
content
updates:
SSL
‐
VPN
clients,
GlobalProtect
agents,
dynamic
content
updates
(Applications,
Threats,
WildFire
and
Antivirus).
Context
Switch—Firewall
or
Panorama
The
Panorama
web
interface
allows
you
to
toggle
between
a
Panorama
‐
centric
view
and
a
firewall
‐
centric
view
using
the
context
switch
.
You
can
choose
to
manage
the
firewall
centrally
using
Panorama
and
then
switch
context
to
a
specific
managed
firewall
to
configure
the
firewall
using
the
firewall
user
interface.
The
similarity
of
the
user
interface
on
the
managed
firewalls
and
Panorama
allows
you
to
seamlessly
move
between
the
interfaces
to
administer
and
monitor
the
firewall
as
required.
If
you
have
configured
to
restrict
administrative
access
to
specific
managed
firewalls,
the
Panorama
user
interface
displays
only
the
firewalls/features
for
which
the
logged
‐
in
administrator
has
permissions.
Templates
You
use
templates
to
configure
the
settings
that
managed
firewalls
require
to
operate
on
the
network.
Templates
enable
you
to
define
a
common
base
configuration
using
the
Network
and
Device
tabs
on
Panorama.
For
example,
you
can
use
templates
to
manage
interface
and
zone
configurations,
server
profiles
for
logging
and
SNMP
access,
and
network
profiles
for
controlling
access
to
zones
and
IKE
gateways.
When
you
group
firewalls
to
define
Template
settings,
consider
grouping
firewalls
that
are
alike
in
hardware
model,
and
require
access
to
similar
network
resources,
such
as
gateways
and
syslog
servers.
Using
templates,
you
can
push
a
limited
common
base
configuration
to
a
group
of
firewalls
and
then
configure
the
rest
of
the
settings
manually
on
the
firewall.
Alternatively,
you
can
push
a
larger
common
base
configuration
and
then
override
the
template
settings
on
the
firewall
to
accommodate
firewall
‐
specific
changes.
When
you
override
a
setting
on
the
firewall,
the
setting
is
saved
to
the
local
configuration
of
the
firewall
and
is
no
longer
managed
by
the
Panorama
template.
You
can,
however,
use
Panorama
to
force
the
template
configuration
onto
the
firewall
or
restore
the
template
settings
on
the
firewall.
For
example,
you
can
define
a
common
NTP
server
in
the
template,
but
override
the
NTP
server
configuration
on
the
firewall
to
accommodate
for
the
local
time
zone
on
the
firewall.
If
you
then
decide
to
restore
the
template
settings,
you
can
easily
undo
or
revert
the
local
changes
that
you
implemented
on
the
firewall.
Templates
cannot
be
used
to
define
an
operational
state
change
such
as
FIPS
mode
or
to
enable
multi
‐
vsys
mode
on
the
firewalls.
For
more
information,
see
