Manage Templates

Last updated
Save as PDF

For supported software information, click here.

This article describes how to configure and manage device templates, service templates, and the Versa endpoint client template. Note that the endpoint client template configuration is common across an organization and all devices in the organization. You cannot configure it for individual devices.

You can use configuration templates to deploy configurations across an organization or across devices in an organization. Versa Portal supports three types of templates:

Device template—A device template lets you configure, store, use, and reuse the configuration on a device, and perform mass publishing. A default template is available and you can clone, rename, and make changes to the default template based on your requirements.
Service template—Service templates are service-specific configurations that can be used to configure certain services. They can then be applied to device configurations to enable the services. You can make mass configuration changes using a service template. The changes are not stored in the service template after publishing. Initially, the device list will be empty; devices will appear after you have published. Reload the device list or refresh the page to see the updated device list.
Versa Endpoint Client Template—When you use an endpoint client template, you can attach a VRF to terminate an IPsec tunnel. If you have SASE gateway and remote access VPN services in the same organization, when you publish the VRF configuration, it publishes only to the remote access VPN.

Default Configuration Templates

Titan Portal provides a default configuration. When you create a new site, Titan populates the site's device configuration with the values from the default configuration. You can edit or clone the default template using the organization settings menu in the left menu bar in the Titan dashboard. All sites created after you save the changes use the new values. You can select the new configuration template when you configure a new site.

You can edit defaults for WiFi, networking, security, and steering. For more information, see Configure WiFi, Configure Security, and Configure Traffic Steering. Titan Portal uses only the settings that apply to a device. For example, if a device does not support WiFi, Titan Portal ignores the WiFi settings when creating a site. You cannot edit the LAN or LTE defaults.

Note: When you onboard a new site, the default configuration is applied by default to all sites. If you update the default configuration, it is not automatically applied to a site that has already been created on the dashboard.

To reset a device configuration to the default values, use Easy Quick Picks. See Easy Quick Picks.

Manage Device Templates

An enterprise admin can clone the default template and save the configuration in a new template. You can add and publish the device template configuration to multiple devices that are associated with the template, an operation referred to as a mass publish. When you perform a mass publish, the device Miscellaneous tab configuration is replaced with the template Miscellaneous tab configuration. You can perform a mass publish to publish a configuration to devices, but you cannot use it to publish a configuration to SASE or to a multitenant gateway. Also, mass publish does not support DNS proxy.

When you clone a device template, you have the option to clone the configuration to another template with devices. When you do this, you select a topology, and all the devices associated with that topology are listed. You can select a topology in the Template Type option to create topology-specific templates to access the complete set of configuration options for that topology. For example, a template created using the Spoke topology allows steering with SD-WAN and DIA. If the template type is not configured correctly, the DIA steering option will not appear in the UI.

It is highly recommended that you do not delete or make changes to the WAN and LAN configuration from a device template, to avoid outages. Instead, perform these operations on the individual devices.

You must not delete the default rules from the device templates when performing a mass publish. If you do this, the Easy Quick Picks feature does not function correctly. If any default rules are removed, use the following procedures to restore the functionality:

Lock the device using the enable lock mode option in the honeycomb view in the Titan Portal > Configure page.
Switch the template to the default template.
Publish the configuration.
Clone the device and create a new template.

Any new rules you create in mass publish are automatically placed at the top of the rule list at the device level.

To edit or clone the default configuration template:

Click Templates in the left menu bar to open the templates settings dashboard, and select Device Template. The Device Templates section displays the following information.

Field	Description
Template Name	Displays the name of the configuration template.
# Devices	Displays the number of devices using the template.
Template Type	Displays the default template's topology.
Cross-Connect Port	Displays the HA cross-connect port for HA, HA with Hub, and HA with Spoke templates.
Clone	Click the Clone icon to clone the configuration to another template so that you can customize it.
Delete	Click the Delete icon to delete a custom template. You cannot delete a default template or a custom template that is associated with a device.
Status	Displays the publishing status of the device using this template: Failed Success
Retry Action	Click the Retry icon to republish the failed devices for this template.
Device List	Click the Device List icon to view the devices that use the template. The Red circle with a number in the device list icon shows the number of devices that failed during the publish process.

Click the Clone icon, and then enter information for the following fields.

Field	Description
Clone Option	Select a clone option: Clone Template—Click to clone the configuration to another template without devices. Clone Template with Devices—Click to clone the configuration to another template with devices.
Template Name	Enter a name for the template.
Template Type	Select a template type. A full-mesh template device can be cloned into any topology. If you clone any other topology, such as spoke, it is cloned as a spoke. Full Mesh HA (HA with Full Mesh) HA with Hub HA with Spoke Hub Hub Controller Spoke
Cross Connect Port	For HA, HA with Hub, and HA with Spoke topologies, select the HA cross-connect port. You must select the same HA cross-connect port that is used in the HA site configuration.
Devices	For Clone Template with Devices option, select the devices to copy with the template, and then click Continue. The devices are listed based on the template type (topology) selected, and a template with the device list selected is created.

Click Continue.

To republish a failed device that uses the template:

Click the Retry icon. Click the checkbox for the device or devices you want to republish, or click Select All to select all devices.
Click the Republish button to publish the configuration again.
Click the Device List icon to view the devices that use the template. Use the search option to search by device name. In the device list, the device names shown in black are deployed devices and the device shown in blue are activated devices.

Click the Show Failed/Republish toggle to display the devices if a publish operation failed for any device. For failed devices, click the device checkbox and then click the Republish button to publish the configuration again.

Note: Always republish the configuration to failed devices before adding a new configuration in mass publish.

Publish Device Template Configuration to Multiple Devices

When you publish a device template configuration to multiple devices, all devices associated with the template are selected by default. If you do not want to publish the template configuration to any specific devices, you have the option to add those devices to a new template, which removes them from the current template.

To publish a device template configuration to multiple devices:

Click Templates in the left menu bar to open the templates settings dashboard, and select the Device Template.
In the Configuration > Network screen, click the down arrow next to Save to display the Publish option, and then click Publish.
To publish a device template configuration to all devices associated with the template, in the Device List popup window, click Validate.
To select any specific devices to be excluded from publishing the template configuration:
1. In the Device List popup window, select Specific Devices. The Specific Devices popup window displays, prompting you to create a new template.
2. In the Template Name field, enter a name for the new template, and then click Continue.
3. In the Device List popup window, select the devices that you want to add to the new template, which removes them from the current template. You can click Select All to select all devices for a license type.
4. Click Validate.
In the Configuration Validation popup window, check that all devices are listed, and then click Continue.
- Click the icon to download the CSV file and check the validation message for all devices.
- Click Preview to view the configuration on each device and display a notification if there are any conflicts. The following preview example screen shows that to update firewall rules with antivirus and IPS features, you must upgrade to a higher license tier.
- If the Validation Status column shows any conflicts found, the publish task is skipped for the device.
  Note that mass publishing ignores the configuration validation error in the following scenarios:
  - When a deleted rule in a template does not exist in the published device.
  - When a rule is updated in a template and does not exist in the published device. Mass publish creates the rule in the published device.
  - When a rule is created in a template and already exists in the published device. Mass publish updates the rule in the published device.
Check a blue dot next to the device icon to display the publish status. The blue dot disappears after the task is completed. Use the Refresh icon next to the Device List column to check the publish status. If the publish failed on a device, the blue dot changes to a red dot with the number of devices that failed during the publish process. To view and republish the failed devices, click the Device icon, and then click the Show Failed/Republish toggle. For failed devices, click the device checkboxes and then click the Republish button to publish the configuration again. You can also click the Retry icon in the Retry Action column in the device templates settings dashboard and republish the failed devices.
Click the Tasks icon to track the publish status for each devices.

View Template Configuration Changes

Titan Portal displays a green animated circle in the Template Configuration Changes screen if the default device template configuration is modified for a device template. The changes are applied to the device when you publish the template configuration.

To view device template configuration changes:

Click Templates in the left menu bar to open the templates settings dashboard.
Select Device Template, and then select a template name.
In the Template Configuration Changes screen, click Template Changes.

For example, if you make any configuration changes to a firewall rule in the NEWTEST2 device template, the green animated circle is displayed in the Security tab, in the Security Policy, and in the Firewall Rules section, as shown in the following screens.

The following video describes Versa Titan default template overview and configuration.

Service Templates

You create service templates so that you are able to configure the application-steering, NGFW, and endpoint client properties for Versa Portal instances. After you create a service template, you associate it with a device template.

You can make mass configuration changes using the service template. The changes are not stored in the service template after publishing. Initially, the device list will be empty; devices will appear once you have published. Reload the device list or refresh the page to see the updated device list.

Customers can configure any number of devices in their environment with a one-time service template configuration and publish the configuration to multiple devices. You can click the Tasks icon at the top of Versa Portal dashboard to track the publish status for each device.

To create a service template:

Click Templates in the left menu bar to open the template settings dashboard, and select Service Template. The Service Templates section displays the following information.
Click the service template name, make required changes to the default service template configuration, and then click Publish.
Click the Device List icon to view the devices that use the template. Use the search option to search by device name. In the device list, the device names shown in black are deployed devices and the device shown in blue are activated devices.
Click the Retry icon in the Retry Action column to republish the failed devices that use the service template. Click Select All to select all the devices or click the device checkboxes to select individual devices, then click the Republish button to publish the configuration again.
Initially, the service template has one WAN interface in the zone list. If you have more than one WAN interface, the WAN interfaces list in the Objects: WAN Networks section.

To add a WAN interface:

Click the

icon and enter information for the following fields.

Field	Description
WAN Name (Required)	Enter a name for the WAN interface. This WAN interface will list in the zone selection for all rules.
HA	Select HA to add the WAN interface to an HA device.
PPPoE	Select PPPoE to add the WAN interface to a PPPoE device.
Description	Enter a text description for the WAN interface.

When you add a WAN port, if the device is not an HA or a PPPoE device, enter the WAN name and click Add. If you add a WAN port for HA or for PPPoE, you must select the type of device.

Click Add.
To edit a WAN interface, click the Edit icon to update the WAN interface, and then click Update to save the changes.

To delete a WAN interface, click the icon.

Versa Endpoint Client Templates

For a Versa endpoint client or remote access VPN template, you can view the template name, number of devices, and the devices that use the template. Click the Versa endpoint (SASE) client or remote access VPN template name to configure the Versa endpoint client service for the organization. To configure the Versa endpoint client template, see Configure a Secure Access Service (Remote Access VPN) Template.

The Versa endpoint client template screen also provides a link to download the Versa Endpoint (SASE) client application for Windows, MAC, and Linux operating systems and validate the endpoint client connection. To copy the portal FQDN and enterprise name of the endpoint (SASE) client, click the Copy icon parallel to each field.

You can retrieve the following information and perform the following tasks:

Template Name—Displays the name of the default configuration template.
# Devices—Displays the number of devices using the template.
Status—Displays the publishing status of the devices using this template.
Retry Action—Click the Retry icon to republish the failed devices for this template. Click Select All to select all the devices or click the device checkboxes to select individual devices, then click the Republish button to publish the configuration again.
Device List—Click the Device List icon to list the devices that use the template. The Red circle in the device list icon shows the number of devices that failed during the publish process.

Click the Device List icon to view the devices that use the template. Use the search option to search by device name. In the device list, the device names shown in black are deployed devices and the device shown in blue are activated devices.

Click the Show Failed/Republish toggle to display the devices if a publish operation failed for any device. For failed devices, click the device checkbox and then click the Republish button to publish the configuration again. You can also click the Retry icon in the Retry Action column and republish the failed devices.

If the SASE gateway or remote access VPN license has expired, the device name displays a blue notification.

Supported Software Information

Releases 11.2 and later support all content described in this article.