Templates in one stack set the same value differently
At a glance
Base severity
Area
Platform
Evidence level
Benchmark reference
Reads the export, not the device
ConfigProof reads a configuration export. This control is evaluated against the objects in that file, and it reports what the file says. It does not connect to the device and sees no traffic, so a finding here describes the configuration, not what the firewall is doing right now.
Why it matters
An operator editing the template that is not first will see no change on the devices the stack serves. The estate holds two answers and only one of them is doing anything.
How to fix it
Web interface
The steps below are written for the web interface. A finding raised on your own export carries the same steps with your object names filled in.
- Decide which value is intended for the devices this stack serves.
- Remove the setting from the templates that are not meant to supply it.
- Where both templates are shared with other stacks, split the setting into a template of its own.
Command line
Panorama CLI
delete template <template> config <setting-path>An example. Values in angle brackets are yours to supply; a finding on your own export fills in the names it read. Nothing here commits or pushes. Review, commit, then push to your devices yourself.
Read it back
show template-stack <template-stack>Values to fill in3
- <template>
- The template that holds this setting
- <setting-path>
- The setting that is set in both templates
- <template-stack>
- The template stack
Before you type it3
- The managed devices keep running their current policy until you push.
- The order of templates in the stack decides which value wins.
- This setting lives on a device or in a template. On a Panorama, name the template it belongs to.
How to confirm the fix
- Confirm no other stack depends on the value you remove.
- Read the setting back from one device the stack serves and confirm it matches the intended value.
Limits
- A defined subset of template settings is compared: banner, timezone, DNS, NTP, update server and domain. Other settings may also conflict.
Compliance references
No benchmark recommendation is mapped to this control in this version.
More in Panorama Advanced
- PAN-MGT-004Rule defined in every child of a device group
- PAN-MGT-005Inherited rule treated differently in a child device group
- PAN-MGT-006Rule references an object outside its inheritance chain
- PAN-MGT-007Object redefined in a device group that inherits one with the same name
- PAN-MGT-009Template stack member whose settings are all supplied above it
- PAN-MGT-010Template stack names a template that does not exist
- PAN-MGT-011Template variable used with no declaration
- PAN-MGT-012Template variable declared and never used
See it on your own firewall
One complete analysis of one firewall costs nothing. A card is required and nothing is charged.