Based on the screenshots above, and with no configuration inside the Template Stack itself, what access will the device permit on its Management port?
Based on the screenshots above, and with no configuration inside the Template Stack itself, what access will the device permit on its Management port?
The firewall will allow HTTP, Telnet, HTTPS, SSH, and Ping from IP addresses defined as $permitted-subnet-1. This is because Device_Temp has higher priority in the template stack, which means its settings take precedence. Permitted IP addresses do not merge, so only $permitted-subnet-1 will be used. Additionally, SNMP is disabled in Device_Temp, negating its configuration in Regional_Temp.
I just tested in my panorama by making the same thing and when you have a permitted IP in both templates it only pushes config from the top one. Making A the only possible answer.
The Panorama will push values from both templates, if any conflict is present it will take the value from the top template.
Your answer contradicts your comment.. There are 3 conflicts meaning it can't be C (based on your own comment)
OK, here is old Frankies take: The firewall will allow HTTP Telnet, HTTPS, SSH, and Ping from IP addresses defined as $permitted-subnet-1 and since Permitted IP Addresses is a duplicate, it will prefererence the higher template. Now it will also allow SNMP as it's in the lower template but, for this example, SNMP is still only applied to $permitted-subnet-1 rendering the other answers useless, so it's A. Bottom line is Permitted IP Addresses is duplicate, as are most of the other (http, https, ssh, ping) but Telnet and SNMP are unique in each template but will still only apply to $permitted-subnet-1.
100%A IPs will never be merged and also SNMP already disabled by the first template ...
https://live.paloaltonetworks.com/t5/panorama-discussions/panorama-force-template-value-option/td-p/496620 "- Force Template Value will as the name suggest remove any local configuratio and apply the value define the panorama template. But this is valid only for overlapping configuration" "You need to be careful, what is actually defined in the template. For example - if you decide to enable HA in the template, but after that you decide to not push it with template and just disable it again (remove the check from the "Enable HA" checkbox). This still will be part of the template, because now your template is explicitely defining HA disabled. If you made a change in the template, and later decide that you don't want to control this setting with template, you need to revert the config by clicking the green bar next to the changed value"
On the 1/23/24 exam
A, as per procheeseburger, i tested this as well in my lab.
Just did a lab and found that services pushed from both templates, while the permitted subnets only pushed from the top template. So, if my lab is valid/correct, the answer should be: 1. If based on the services, C should be correct (if subnet2 is removed) 2. If based on the permitted subnets, A is correct (if snmp is added)
this was one of the questions of todays exam
The question said and "no configuration inside the Template Stack itself" I would say A
Green bar next to value means value is explicitly specified. As higher template takes priority, the SNMP setting will be taken from device-template which has snmp explicitly disabled.
Apologies. This actually gives an answer of A, as permitted IP addresses do not merge. (tested on 10.1)
c is for cookie
Device_Temp is higher in priority so SNMP will be disabled and permitted IP address will be combined. Reference: https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/manage-templates-and-template-stacks/configure-a-template-stack
I tested this in lab, A is correct. In the 3rd screenshot you can see that DEVICE_TEMP has higher priority. This is why the $permitted-subnet-1 takes precendence and also the configured SNMP checkbox in REGIONAL_TEMP won't take effect because of this. The info text in Panorama GUI for Template Stacks is: The Template at the top of the Stack has the highest priority in the presence of overlapping config
A is correct
A Permitted IP addresses do not merge