Panorama Centralized Management: Templates and Device Groups. The core problem is simple: managing one firewall is easy, but managing fifty or five hundred firewalls individually is a nightmare of time, errors, and inconsistency. For the PCNSE exam, you need to understand how Panorama solves this by separating configuration into reusable building blocks so you can push changes to thousands of firewalls with a single click.
Jump to a section
A simple way to picture Panorama Centralized Management: Templates and Device Groups
Have you ever eaten at a chain restaurant and noticed that the burger tastes the same whether you're in London or Manchester? How does a global brand ensure every single kitchen follows the same recipe, uses the same equipment, and keeps the same opening hours, without flying a manager to every location daily?
That's exactly what Panorama does for a fleet of firewalls. Imagine you own a chain of 50 burger joints. Each restaurant is a firewall. If you want to change the cooking temperature for the fries (a network setting in a template), you don't phone each chef individually. You write a single 'temperature policy' in your head office (Panorama), and every restaurant automatically updates its ovens. If you want to block a specific ingredient (a security rule in a device group), you update the master ingredient list once, and all kitchens stop ordering it. The head office doesn't cook the food itself — it just tells each kitchen how to cook. Similarly, Panorama doesn't process your network traffic; it pushes standardised settings and policies to every firewall, ensuring consistency. If a new restaurant opens, you just assign it the same template and device group, and it instantly knows the corporate recipe. No manual setup, no 'your burger is different' complaints.
To understand Panorama, you first need to know what a firewall does in a network. A firewall is a security guard that sits between your internal network (like your company's private offices) and the internet. It decides which traffic is allowed in and out based on rules. Now picture a company with offices in London, New York, Tokyo, and Sydney. Each office has its own firewall. If the company wants to block a new malicious website across all offices, the old way was to log into each firewall separately and type the same rule four times. This is slow and error-prone. You might type the rule correctly in London but miss a typo in Sydney.
Panorama is a central management platform from Palo Alto Networks. It is a single console that lets you manage all your firewalls from one place. It does not replace the firewalls. The firewalls still inspect traffic and enforce rules. Panorama just sends them instructions. Think of Panorama as the head office that writes the manuals, and each firewall is a branch that follows the manual.
The two most important building blocks in Panorama are Templates and Device Groups. They serve completely different purposes.
A Template is for settings that control how the firewall itself works — its network configuration. This includes IP addresses, interface settings (the physical ports on the firewall), VLANs (virtual local area networks that segment traffic), routing protocols (how the firewall finds paths through the network), and VPN (virtual private network) settings. Templates are like the blueprint for the house. They define the plumbing, the electrical wiring, the layout of rooms. Every firewall in the same template gets the same network blueprint.
A Device Group is for security policies — the rules that decide what traffic is allowed or blocked. This includes Security rules (allow or deny traffic based on source, destination, application, and user), NAT rules (Network Address Translation, which hides internal IP addresses), and Decryption rules (to inspect encrypted traffic). Device groups are like the house rules. One house might have a rule 'no pets allowed', another might allow dogs but not snakes. All firewalls in the same device group share the same security rules.
Why does Panorama separate templates and device groups? Because in real companies, network settings and security policies change at different speeds and for different reasons. Your network IP addresses might stay the same for years, but your security rules might change every week as new threats appear. By separating them, you can update security rules (device groups) without touching the network configuration (templates). You can also have a hierarchy. You can create a base template with general settings (like 'all firewalls in the UK get this time zone and DNS server') and a child template with specific settings (like 'the London office has this unique IP address'). The child template inherits everything from the base template and then adds or overrides specific values. The same inheritance works for device groups. You can have a global device group with rules that apply to every firewall, and then child device groups for each region that add local rules.
Panorama also handles log collection. Each firewall generates logs every time traffic passes through it. Logs are records of who connected to what, when, and whether it was allowed or blocked. Without Panorama, you would have to log into each firewall to see its logs. With Panorama, you can forward all logs from every firewall to a central Panorama log collector. You can then search across all firewalls from one place, run reports, and detect security incidents that might only become visible when you see traffic patterns across all offices.
To manage this, Panorama uses a 'commit and push' model. You first configure the template or device group on Panorama. Then you 'commit' your changes, which saves them to Panorama's database. Finally, you 'push' the committed configuration to the firewalls you select. The firewalls then apply the new settings. If you make a mistake, you can roll back to a previous configuration. This is far safer than making changes directly on each firewall.
In summary, Panorama turns the messy job of managing many firewalls into a structured, repeatable process. Templates handle the 'how the firewall connects to the network' part. Device groups handle the 'what traffic is allowed' part. Together, they give you central control, consistency, and efficiency.
1. Initial Setup: Deploy Panorama
Install the Panorama virtual or hardware appliance in your network. Configure its basic network settings (IP address, DNS, default gateway). This is the central brain. Without this, you cannot manage any firewalls centrally.
2. Create Templates for Network Settings
Create a template (e.g., 'Standard-Office-Template'). Inside it, define the network interfaces, static routes, VLANs, and DHCP server settings. These are the network blueprints. All firewalls assigned to this template will share these settings unless you use variables or child templates to override specific values.
3. Create Device Groups for Security Policies
Create a device group (e.g., 'Global-Blocklist'). Inside it, create Security rules, NAT rules, and Decryption rules. These are the security rules. Any firewall assigned to this device group will enforce these rules. You can create child device groups for region-specific rules.
4. Assign Firewalls to Templates and Device Groups
In Panorama, 'add' each managed firewall to the Panorama inventory. Then assign the firewall to a template stack (a list of templates in priority order) and a device group. Each firewall must have at least one template and one device group assigned to receive configuration.
5. Commit and Push Configuration
After making changes, click 'Commit' on Panorama to save your work to its database. Then select the firewalls you want to update and click 'Push'. Only the pushed firewalls receive the new configuration. This step-by-step approach prevents accidental global changes.
6. Configure Log Collection (Optional but Recommended)
Set up a Collector Group in Panorama. Configure your firewalls to send logs to the Panorama collector. Then you can view all logs from the Panorama 'Monitor' tab. This is essential for auditing and threat detection across the enterprise.
7. Test and Verify
Log into a managed firewall directly (or check Panorama's 'Managed Firewalls' page) to verify that the correct configuration was applied. Generate test traffic to ensure security rules are working. If something is wrong, you can roll back the push or correct the template/device group and re-push.
Consider a real company called 'ShopGlobal', an e-commerce retailer with offices in London, Frankfurt, Singapore, and San Francisco. They have 200 firewalls deployed across these sites, plus a data centre in Virginia that hosts their website. The company hires a new network security engineer named Priya. Her first task is to block a new ransomware domain that the threat intelligence team flagged.
Priya logs into Panorama. She sees a central dashboard listing all 200 firewalls. She opens the Device Group section. The company uses a hierarchical device group structure: there is a parent device group called 'Global-Policies' and three child device groups: 'EMEA', 'APAC', and 'Americas'. The global parent contains rules that apply everywhere, like 'block known malware domains'. The child groups contain region-specific rules, like 'block gambling sites in EMEA only'.
Priya navigates to the Global-Policies device group. She creates a new Security rule called 'Block-Ransomware-Domain'. She specifies the source as 'any', destination as 'the malicious domain', and action as 'deny'. She then commits the change to Panorama. After the commit succeeds, she selects all 200 firewalls and clicks 'Push'. Panorama sends the new rule to every firewall simultaneously. Thirty seconds later, every single firewall in the company is blocking the ransomware domain. If Priya had to do this manually on each firewall, it would take hours and she might miss a few.
Now imagine a different scenario. ShopGlobal opens a new office in Dubai. They install a new firewall. Priya needs to configure it. She doesn't start from scratch. First, she assigns the new firewall to the 'EMEA' device group so it gets the region's security policies. Second, she assigns it to the 'Standard-Office-Template', a template that contains network settings for all standard offices: IP address scheme, DNS server addresses, NTP (Network Time Protocol) server for clock synchronisation, and interface configurations. The template already has a variable system that allows her to specify the unique IP address for the Dubai office without editing the template itself. She fills in the variable values (like the interface IP) for the new firewall, commits, and pushes. The firewall is fully configured in minutes. Without Panorama, she would have to configure the interface, routing, security policies, and object addresses manually.
Priya also uses Panorama's log collection regularly. When a user reports that a legitimate website is not loading, she searches the central logs. She finds that the traffic was denied by a specific rule in the 'APAC' device group. She realises the rule was too broad. She modifies the rule in Panorama, commits, and pushes to only the APAC firewalls, not affecting the rest of the world. This targeted update saves time and avoids disrupting users in other regions.
In day-to-day operations, the engineer will use Panorama to:
Deploy new firewalls rapidly using templates.
Update security rules globally or per region.
Monitor logs and generate compliance reports.
Perform audits by checking which firewalls have which policies.
Troubleshoot issues by comparing configurations across firewalls.
The PCNSE exam tests your understanding of Panorama in several specific ways. The exam is multiple-choice and scenario-based. You will see questions that present a situation and ask what the correct configuration step or outcome is. The exam expects you to know the exact difference between templates and device groups, and when to use each.
Key concepts the exam tests repeatedly:
Templates are for network configuration (interfaces, routing, zones, VPN, authentication profiles).
Device groups are for security policies (Security rules, NAT rules, Decryption rules, Policy Optimisation).
Templates can have variables (like $IP-ADDRESS) that you fill in per firewall. Device groups do not use variables in the same way.
Changes are made in Panorama, then committed locally, then pushed to firewalls. The order matters. If you only commit without pushing, the firewalls do not get the changes.
Panorama can manage firewalls running different versions of PAN-OS, but there are limitations on which features are available.
There is a concept of 'template stack' — a list of templates applied in order. The highest priority template overrides the lower ones for conflicting settings.
Device groups also form a stack. The firewall inherits rules from all parent device groups. If two rules conflict, the more specific or higher-priority rule wins (this is more complex; the exam will test that rules from a child device group are evaluated before rules from a parent, but the action of the first matching rule is applied).
Common traps the exam sets:
They might describe a scenario where you need to change a network setting and ask whether to use a template or a device group. The correct answer is always template for network settings, device group for security rules. Do not confuse them.
They might list multiple steps and ask what happens after a 'commit' vs a 'push'. A commit saves to Panorama; a push sends to firewalls. If a question says 'the engineer committed the change but users report no change', the answer is that the engineer forgot to push.
They might ask about the order of operations in a template stack. The rule is: the template listed last in the stack has the highest priority. This is counterintuitive because it is like a list where you add to the end, and the last addition overrides previous ones.
They might test whether Panorama can manage firewalls from different locations across the internet. Yes, Panorama works over the internet as long as the firewalls can reach the Panorama IP address, but it is more common to have them in the same network.
They might ask about 'commit scope' — you can commit on Panorama only, or commit on a specific device group or template. This allows you to test changes on a subset of firewalls before pushing to all.
Log collection and Collector Groups are a specific exam topic. You need to know that logs are sent to a Collector that then forwards to Panorama. If the Collector fails, logs might be lost or queued.
To prepare, memorise this table: Templates = Network config, Device Groups = Security policies. Practise scenarios: 'A company acquires a new office and needs to add the firewall to the central management. Which two things do you assign?' Answer: a template stack and a device group.
Templates manage network configuration like interfaces, routing, and zones; device groups manage security policies like allow/deny rules.
A template stack and a device group are both assigned to a firewall, but they control entirely different parts of the configuration.
Committing saves the configuration to Panorama; pushing sends it to the firewalls — both steps are required for changes to take effect.
Device groups and templates support inheritance: a child inherits settings from its parent and can override specific values.
Logs from all firewalls can be centralised on Panorama, allowing you to search and report across the entire fleet from one place.
Panorama does not replace firewalls; it only manages them. Traffic still flows through each individual firewall.
You can use template variables to assign unique values (like an IP address) per firewall while using the same template.
The PCNSE exam will test the difference between templates and device groups with scenario-based questions — memorise which type of setting goes where.
These come up on the exam all the time. Here's how to tell them apart.
Template
Controls network settings: interfaces, routing, zones, VPN, DHCP.
Uses variable support to assign unique values per firewall.
Changes affect how the firewall connects to the network.
Device Group
Controls security policies: Security rules, NAT rules, Decryption rules.
Does not support variable substitution for unique values (uses objects instead).
Changes affect which traffic is allowed or blocked.
Commit
Saves configuration to Panorama's local database.
Does not send anything to firewalls.
Must be done before a push can occur.
Push
Transmits the committed configuration to selected firewalls.
Is a separate step after commit.
Only changed settings are sent; unchanged ones remain.
Panorama
Central management appliance.
Does not process traffic.
Collects logs from multiple firewalls.
Firewall
Edge security device that inspects traffic.
Processes all network traffic and enforces rules.
Generates logs only for its own traffic.
Template Stack
An ordered list of templates applied to a firewall.
Last template in the stack has highest priority.
Used for network configuration only.
Device Group Hierarchy
A tree structure of parent and child device groups.
Child group rules are evaluated before parent group rules.
Used for security policies only.
Mistake
Templates and device groups are the same thing, just named differently for different companies.
Correct
Templates and device groups serve completely different purposes. Templates manage network settings (how the firewall connects to the network). Device groups manage security policies (what traffic is allowed or blocked).
Both are groups that you assign firewalls to, so beginners assume they are interchangeable. The exam punishes this confusion heavily.
Mistake
I can configure security rules inside a template.
Correct
Security rules (allow/deny) can only be configured in device groups. Templates only contain network-level settings like interfaces, routing, and zones.
The word 'template' sounds like a general thing that could contain any settings, but Palo Alto Networks has a strict separation.
Mistake
When I commit changes on Panorama, the firewalls immediately get the new configuration.
Correct
Committing only saves the changes to Panorama's database. You must then perform a separate 'push' operation to send the configuration to the selected firewalls.
The term 'commit' is used differently in other systems (like a database commit) where the change is final. Beginners miss that Panorama requires an extra step.
Mistake
I can manage up to ten firewalls with Panorama without any licences.
Correct
Panorama itself is a licensed product. You need to purchase a Panorama licence, and each firewall you manage also needs a Panorama management licence. There is no free tier.
Beginners often think central management is a built-in free feature, like a web interface. It is a separate paid product.
Mistake
Panorama processes my network traffic like a firewall does.
Correct
Panorama is a management appliance, not a firewall. It does not inspect or forward traffic. It only sends configuration to firewalls and collects logs from them.
The name 'Panorama' sounds like a big security device. Newcomers confuse it with a firewall. In reality, it is invisible to network traffic.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
No. Panorama only manages Palo Alto Networks firewalls. It cannot manage firewalls from Cisco, Fortinet, or any other vendor.
A template is a single set of network settings. A template stack is an ordered list of templates applied to a firewall. The template at the top of the stack has the highest priority and overrides conflicting settings from lower templates.
Panorama is available as a virtual appliance (VMware, Hyper-V, KVM) or as a dedicated hardware appliance. You do not need a separate server if you run the virtual version on existing infrastructure.
Yes. When you click 'Push', you can select specific firewalls or device groups to push to. The exam tests that you understand this selective push capability.
The firewall continues to operate with its last pushed configuration. It does not stop working. When the connection is restored, Panorama will sync any pending changes.
Log storage depends on the Panorama model and configuration. You can set retention policies to delete old logs or archive them. For long-term storage, you might export logs to an external syslog server.
Technically yes, but Panorama is designed for enterprise environments with many firewalls. It is overkill and costly for a single home firewall.
You've finished Panorama Centralized Management: Templates and Device Groups. Continue through the PCNSE study guide to build a complete picture of the exam.
Done with this chapter?