There are specific tasks that cannot be configured from Panorama using a template stack. Renaming a vsys on a multi-vsys firewall is one such task because it involves changes to the identifier of the virtual system, which requires local access. Changing the firewall management IP address also must be done locally, as it relates to the fundamental network configuration of the firewall which Panorama cannot alter. Enabling operational modes such as normal mode, multi-vsys mode, or FIPS-CC mode cannot be configured from Panorama because these modes involve fundamental changes to the firewall's operation that require direct access and potentially a system reboot.