Which two settings can be configured only locally on the firewall and not pushed from a Panorama template stack? (Choose two.)

Question

Options

• AHA1 IP Address
• BMaster Key
• CZone Protection Profile
• DNetwork Interface Type

• A
  90% (37)
• C
  7% (3)
• D
  2% (1)

Explanation

HA1 IP Address (A) and Master Key (B) are locally-only settings because they are inherently device-specific. The HA1 IP address identifies a firewall uniquely within an HA pair - pushing the same IP to multiple devices would create conflicts, so each firewall must configure it locally. The Master Key encrypts all private keys and sensitive credentials stored on the device; it is a node-level security construct that Panorama cannot distribute, ensuring each firewall's encryption remains independently controlled.

Zone Protection Profiles (C) are wrong as a distractor - these are standard security objects that Panorama can define in a template and push across all managed firewalls, which is a primary use case for centralized policy management.

Network Interface Type (D) is also wrong - interface types (Layer 3, Layer 2, Virtual Wire, etc.) are a core part of what Panorama template stacks exist to configure and push uniformly to devices.

Memory tip: Think "HAMI" - HA IPs and Master Keys are the two things that are "mine alone." Anything that must be unique per box (HA IPs) or too sensitive to transmit centrally (Master Key) stays local. Everything else - profiles, interface types, zones - is fair game for Panorama templates.

No community discussion yet for this question.