©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
95
Manage
Firewalls
Manage
Templates
Add
a
Template
Step
1
Add
a
new
template.
1.
Select
Panorama > Templates.
2.
Click
Add
and
enter
a
unique
name
and
a
description
to
identify
the
template.
3.
(Optional)
Select
the
Virtual Systems
check
box
if
this
template
will
be
used
for
devices
that
are
multi
‐
vsys
capable
and
are
enabled
for
multi
‐
vsys
functionality.
A
commit
failure
will
occur
if
a
template
enabled
for
devices
with
multi
‐
vsys
capability
is
pushed
to
devices
that
are
not
multi
‐
vsys
capable
or
are
not
enabled
for
the
multi
‐
vsys
functionality.
4.
Specify
the
Operational Mode
for
the
devices
to
which
the
template
will
be
applied.
The
default
is
normal;
change
to
cc
or
fips
,
as
required.
The
template
commit
will
fail
if
there
is
a
mismatch
in
the
operational
mode
specified
on
the
template
with
what
is
enabled
on
the
devices
included
in
the
template.
5.
(Optional)
Select
the
VPN Disable Mode
when
creating
templates
for
hardware
models
that
have
the
‐
NV
indicator
in
the
model
name;
these
models
are
hard
coded
to
disallow
VPN
configuration
for
countries
that
do
not
allow
VPN
connectivity.
6.
Select
the
Devices
(firewalls)
for
which
you
plan
to
use
this
template.
You
must
select
the
firewalls
individually.
Whenever
you
add
a
new
managed
firewall
to
Panorama,
you
must
assign
it
to
the
appropriate
template;
Panorama
does
not
automatically
assign
new
firewalls.
When
you
perform
a
template
commit,
Panorama
pushes
the
configuration
to
every
firewall
assigned
to
the
template.
7.
(Optional)
Select
the
Group HA Peers
check
box
for
firewalls
that
are
set
up
as
a
high
availability
(HA)
pair.
PAN
‐
OS
synchronizes
some,
but
not
all,
configurations
between
HA
peers.
For
active/passive
HA,
select
Group HA Peers
so
that
both
will
receive
the
configurations.
For
active/active
HA,
whether
you
select
Group HA Peers
depends
on
whether
each
peer
must
receive
the
same
configurations.
For
a
list
of
configurations
that
HA
synchronization
includes
and
excludes,
see
.
8.
Click
OK
.
9.
Click
Commit
,
and
select
Panorama
as
the
Commit Type
to
save
the
changes
to
the
running
configuration
on
Panorama.
10.
Click
Commit
,
and
select
Template
as
the
Commit Type
to
push
the
changes
to
the
devices
included
in
the
template.
Step
2
Verify
that
the
template
is
available.
After
you
add
the
first
template,
the
Device
and
Network
tabs
will
display
on
Panorama.
In
the
Network
and
Device
tabs,
a
Template
drop
‐
down
displays.
Verify
that
the
newly
added
template
displays
in
the
drop
‐
down.
