Templates Best Practices

Configuration templates allow administrators to effectively deploy and manage common configurations across a group of firewalls, which minimizes the administration efforts and time. For more information, refer to Templates.

Follow these recommendations to better utilize and apply the templates feature:

• Adding more firewalls than the maximum recommended firewalls per template might result in high latency. The maximum recommended number of firewalls per template in SaaS and On-Premises is 1000.

• Limit configurations within a single template. Create multiple templates to segment configurations, making it easier to identify and resolve errors.

  Keep dependent configurations within the same template to avoid issues.

• If a template includes many configuration changes—such as add, modify, or delete—create a new template for onboarding new firewalls. Include only the final configuration to minimize unnecessary API operations, prevent customer confusion, and avoid deployment delays.
• Use the Export/Import CSV feature to populate variable values if a template includes many variables across multiple firewalls. This helps prevent manual entry errors and avoids session timeouts.

Security Settings Enabled by Default in SonicOS 8.2.3 Templates

For firewalls running SonicOS 8.2.3 or later, the following security settings use these defaults in Firewall View and Template View:

• Enable Stealth Mode is enabled (Network > Firewall > Advanced > Settings).
• Randomize IP ID is enabled (Network > Firewall > Advanced > Settings).
• The action of the default deny access rules is Discard.
• SSL Control is enabled, and the Log the event option is enabled.
• IPsec VPN is disabled. The firewall does not listen on UDP ports 500 and 4500. Enable VPN before you configure IPsec VPN.

These defaults apply only to firewalls running SonicOS 8.2.3 or later. If you apply a template to firewalls running SonicOS 8.2.2 or earlier, these settings are not applied. In a group of firewalls with mixed versions, only the firewalls running SonicOS 8.2.3 or later receive these settings.

Custom Captive Portal in Templates

For firewalls running SonicOS 8.2.3 or later, you can configure a custom captive portal (login page, branding, and user types) in both Firewall View and Template View. For configuration details, refer to the SonicOS documentation.

OAuth 2.0 for Mail Server Settings in Templates

For firewalls running SonicOS 8.2.3 or later, you can configure OAuth 2.0 authentication for Mail Server Settings (Log > Automation > Mail Server Settings) in both Firewall View and Template View. Note the following behavior:

• In Template View, OAuth2 Client ID, OAuth2 Client Secret, and OAuth2 Redirect URI must be variables.
• In Template View, the Login, Logout, and Test buttons are disabled.
• In Firewall View, the Login button is disabled. The Logout button logs the user out of the OAuth server, and the Test Settings button is available.

Basic authentication remains available for older mail servers. Basic authentication is less secure, and a warning is displayed. Use OAuth 2.0 whenever the mail provider supports it.

Prerequisites and Best Practices for using Golden Templates

• Ensure that the source and target firewalls:

  • Are running the same firmware version for successful deployments
  • Are of the same models
  • Licenses are identical

  • Are in In Sync state

    If the firewall is not In Sync state, synchronize according to Synchronizing a Firewall Configuration with Firewall Management.

    NSM/Firewall Management does not export pending configurations from the source firewall as part of the golden template. Apply all pending configurations to the source firewall before exporting the template.

• Ensure that the target firewall is reset to factory settings.
• Create a device group structure as per the requirements of the organization. For more information, refer to Device Groups.
• Whenever applicable, use the EXP-based golden template introduced in NSM 3.2.0. This feature exports the source firewall configuration as an exp based template, making it easier to standardize deployments across multiple environments and reduce configuration errors. For more information, refer to Exporting the Firewall Configuration as an Exp Golden Template.
• Some configurations will not be exported to the template. For more information, refer to the Unsupported Template Configurations.
• Review the WAN interface settings before applying the template to the target firewalls.