NSM – Template Dos and Don'ts

Description

Templates allow for the effective deployment and management of common configurations across firewalls within the NSM Tenant. Templates in NSM have the following behaviors:

Things to note:

  1. Template records every activity for each change included and performs those steps in order when applied to Firewalls. It’s recommended to check ‘View Template Details’ of the Template and verify the steps before applying to the Firewall/s or Group.

    For example: Adding an address object named ‘Google DNS’ and then renaming that to ‘Public DNS’ and finally deleting it from the template. This address object is no more visible in the template UI and shouldn’t be applied, but when the template is applied to a firewall/s, the above steps will be performed in the same sequence: creating the address object, renaming it, deleting it. This may lead to failed commits or setting mismatches.

  2. Currently, there are no validation checks in the Template, which may lead to errors/issues when applying specific changes to firewalls.

    For example: An address object called ‘Google DNS’ is created and used in an Access Rule. Later, if the name is changed to ‘Public DNS’, the Access Rule loses its association with the ‘Google DNS’ and is replaced with the default ‘any’.

  3. The Template can be deleted from NSM, but once a template is applied to an NSM group, changes remain on the group, even if the template is deleted and no longer exists in NSM. Previous changes through that Template are still applied to the group and underneath firewalls.

  4. Interface Configurations in the SonicWall firewall are stored as an array. Let’s say X0 has been configured with the following:

    • Example 1: 192.168.1.254/255.255.0.0, default gateway 192.168.7.1, with HTTPS disabled, SNMP enabled.
    • To change the interface IP from 192.168.1.254 to 192.168.1.1 using a template, it will push the IP address along with the default settings of the X0 interface, like:
      • 192.168.1.1/255.255.255.0, default gateway 0.0.0.0, HTTPS enabled, SNMP disabled, etc.
    • Example 2: If only HTTPS Management is disabled on the WAN interface using a Template, the Template will push other default settings. This will change the WAN IP Mode/IP Assignment to DHCP as DHCP is the default value.
    • Currently, partial updates of configuration settings are not supported.

Note: The JSON actions of Template can be viewed by clicking on ‘View Template Details’.

  1. It’s recommended to create a new Template instead of using an existing Template with pre-existing configuration. This will help avoid any unwanted changes pushed to firewalls.

  2. Instead of using a large template, it's recommended to create multiple templates with a small set of changes for specific settings as needed.

Refer to the technical document for more information:

Technical Document on NSM Templates