Skip to main content

 

 

Cisco Defense Orchestrator

Apply an FTD Template

About Applying FTD Templates

Before applying a template, you can identify its contents by navigating to the Devices & Services page and filter for Model/Template. CDO displays the corresponding template part icons to show the parts included in that template. This information also appears in the Device Details pane when you click the device or when you hover over the mouse pointer on the icon.

Apply a Complete Template

Applying a complete Firepower Threat Defense (FTD) template to create a new FTD overwrites entirely any existing configuration on the FTD, including any staged changes that have not yet been deployed from CDO to the device. Anything on the device that was not included in the template will be lost.

Apply a Custom Template

Applying a custom Firepower Threat Defense (FTD) template to other FTDs will retain or remove the existing configuration based on the template part. The following table provides the changes that occur after applying the custom template on other FTD devices.

Template Parts After Applying Custom Template
Access Rules
  • New access control rules present in the custom template overwrites any existing access control rules on the device.  
  • New objects and interfaces (with sub-interfaces), if any, in the custom template are applied to the device without deleting any existing objects and interfaces.
NAT Rules
  • New NAT rules present in the custom template overwrites any existing  NAT rules on the device.
  • New objects and interfaces (with sub-interfaces), if any, in the custom template are applied to the device without deleting any existing objects and interfaces.
Settings
  • New system settings from the custom template are applied to the device without deleting any existing system settings.
  • New objects and interfaces (with sub-interfaces), if any, in the custom template are applied to the device without deleting any existing objects and interfaces.
Interfaces 
  • New interfaces and sub-interfaces from the custom template are applied to the device without deleting any existing interfaces and sub-interfaces.
Objects
  • New objects from the custom template are applied to the device without deleting any existing objects.
  • New interfaces and sub-interfaces, if any, in the custom template are applied to the device without deleting any existing interfaces and sub-interfaces.

Applying the template to a device is a three-step process. 

  1. Apply the template to the device.
  2. Review device and network settings.
  3. Deploy the changes to the device.

Prerequisites

The following conditions must be met prior to applying a template:

  • When using a template, be sure that any changes you have made to the template have been committed and that the template is in the "Synced" state on the Devices & Services page.
  • When using an FTD device as a template, be sure that any changes on CDO you intended to deploy to the device have been deployed and that there are no changes from the FDM console that have not been deployed. The device must show a Synced state on the Devices & Services page.

Apply Template to an FTD

Important: Before you deploy the changes to the device, continue to the next procedure: Review Device and Networking Settings

You can use change request tracking to apply a tracking label to your changes before you apply the template. Use the following procedure to apply an FTD template:

  1. (Optional) Before you begin, make a template of your FTD device before you apply another template to it. This gives you a configuration backup you can reference when you need to reapply device and networking settings.
  2. In the CDO navigation bar, click Devices & Services.
  3. Use the Devices & Services filter and search field to find the FTD device or template to which you are going to apply the template. 

Note: If you change the name of the template at this point, you are applying a full device configuration or template to DeviceName. Deploying this change to DeviceName will overwrite the entire configuration running on that device.

  1. In the device Actions pane on the right, click Apply Template.
  2. Click Select Template and select the desired template and click Continue.
  3. You can configure the following and click Continue appearing on each screen. 
    1. Map Interfaces: Confirm or change the mapping of interfaces between the template and the device. Note that you cannot have more than one template interface mapped to a single device interface; if the interface configuration is not supported, you cannot continue and apply the template. 
    2. Fill Parameters: Customize the interface or sub-interface parameter values for the device that you are applying the template to. 
    3. Review: Review the template configuration and click Apply Template when you are ready to overwrite the existing device configuration with the configuration in the template.
  4. Click Review and deploy now the changes you made, or wait and deploy multiple changes at once.

Review Device and Networking Settings

When creating an FTD template, CDO copies the entire device configuration into the template. So, things like the management IP address of the original device are contained in the template. Review these device and network settings before you apply the template to a device:

  1. Review these FTD device settings to ensure that they reflect the correct information for the new FTD device: 
  1. Review the Firepower access control policy to ensure that rules reference the new FTD's IP addresses where appropriate. 
  2. Review inside_zone and outside_zone security objects to ensure they reference the correct IP address for the new FTD.
  3. Review NAT policies to ensure they reference the correct IP addresses for the new FTD.
  4. Review Interface configurations to ensure that they reflect the correct configuration for the new FTD.

Deploy Changes to the Device

Review and deploy now the changes you made, or wait and deploy multiple changes at once.

 

Related Topics

 

  • Was this article helpful?