Course contents

Unit 5: Onboarding and trustLesson 5.4 (4 of 5 in this unit)24 of 27 in the Cisco SD-WAN course

Classic templates, configuration groups and feature profiles

How the Manager delivers configuration: feature and device templates, configuration groups, feature profiles and variables, and where a setting should live.

Intermediate · 10 min read

You'll learn to compare classic templates with configuration groups, say what a feature profile and a variable are, and decide where a setting should live so that one change reaches every router that needs it.

Technical definition

Template or configuration group is a way to describe a router's configuration once in the Manager and apply it to many routers. Classic templates combine feature templates into a device template. Configuration groups, the newer method, collect feature profiles for a set of devices. In both, values that differ per router are variables.

Many branches and one change

BR-01 and BR-02 are two of many branches. Each needs a system IP, a site ID, a transport interface with its own address, a colour and a list of services. Most of the rest is the same everywhere: the NTP servers, the logging host, the banner, the tunnel interface settings. Typing all of this on every router is slow and drifts out of step over time. The Manager's answer is to hold the configuration centrally and push it. Onboarding, covered in the previous lessons, only gets a router connected. This lesson is about what it then receives.

Classic templates

The older and still common method has two layers.

Classic templates
Classic templatesFeature templates are combined in a device template.Feature templatesDevice templateAttachto devicesPush

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Variables fill each device.
  • Feature templates hold one function each: system settings, a transport interface, a routing protocol, logging. A feature template has fixed values and variable fields.
  • A device template is a list of feature templates for one kind of router. Attach it to a device and give the variables their values, and the Manager builds and pushes the configuration.

Some settings can also be written as raw commands in a CLI template. That is a flexible escape hatch, but it moves the Manager's checking back to you, so use it where no feature template covers the need.

Configuration groups and feature profiles

Configuration groups are a newer model that aims to be simpler to plan. A group is a set of feature profiles, each with a different job, applied to the devices associated with the group.

Configuration groups
Configuration groupsFeature profiles are combined in a configuration group.Feature profilesConfiguration groupDeployto devicesVerify

On small screens, swipe sideways or focus the diagram and use the arrow keys.

The newer approach.
IdeaWhat it is
Configuration groupThe thing you associate devices with. It brings the profiles together.
Feature profileA collection of features of one kind. The kinds usually follow the split of a router into system settings, transport and management, service side (LAN), and extra CLI. The list varies by release.
VariablesPer-device values, supplied when devices are associated or deployed, for example from a file or by hand
DeployThe Manager checks the group and pushes it to the associated devices

Profiles can be reused by more than one group, so a transport profile built once may serve many site types. Policy is organised in its own groups in newer releases, apart from the device configuration. This course covers policy in later units.

Side by side

Side by side
Side by side; Classic templates; Configuration groups. Building blocks: Feature templates inside a device template Feature profiles inside a configuration group Per-router values: Variables on the attached template Variables on the associated device Reuse: A feature template can be used by many device templates A profile can be used by many groups Fit: Long-running networks and wide feature coverage Newer deployments; coverage depends on the release Escape hatch: CLI template or add-on CLI A CLI profile or add-on CLIClassic templatesConfiguration groupsBuilding blocksFeature templates inside a devicetemplateFeature profiles inside aconfiguration groupPer-router valuesVariables on the attached templateVariables on the associated deviceReuseA feature template can be used bymany device templatesA profile can be used by many groupsFitLong-running networks and widefeature coverageNewer deployments; coverage dependson the releaseEscape hatchCLI template or add-on CLIA CLI profile or add-on CLI

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

Do not read the table as a ranking. Both are supported by the Manager, and the feature you need decides which one can carry it in your release.

Templates and groups
Templates and groupsTwo ways to deliver configuration.ClassicFeature and device templatesConfig groupsFeature profilesWorkflow basedvs

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Use what your version supports.

From attach to a working router

  1. The device is known to the Manager. It was onboarded, or it is registered and waiting. See PnP and ZTP and Manual Bootstrap.
  2. Choose the template or group. It must be designed for this router model, as supported features differ between models.
  3. Give the variables values. System IP, site ID, host name, transport address and the like. A mistake here is the most frequent source of a failed push.
  4. Review. The Manager can show the configuration it plans to send. Read it, especially the lines that touch the transport interface the router uses to reach the Manager.
  5. Push. The Manager sends the configuration over the control connection and reports success or failure.
  6. Verify. The router should keep its control connections and form tunnels. See Onboarding Verification and Rollback.

The risk in the push

A template that changes the transport interface, its address, its route or its tunnel interface can cut off the control connection that carried the push. The router then cannot confirm the new state and may not be reachable from the Manager. Some releases include a timer that reverts a configuration the router could not confirm, but that behaviour is release dependent. For the first push to a site, change the minimum, check the transport settings twice, and have console or out-of-band access ready.

The risk in a push
The risk in a pushA bad template reaches many devices at once.Changea templatePushmany devicesErrorspreads fastPilotlimits risk

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Test on one site first.

Learn more: Transport-Side IP and ISP ReachabilityManagerSystem IP and Site ID

Choosing where a setting lives

Choosing where a setting lives
Choosing where a setting livesSetting; Place it; Reason. NTP, logging, banner: Shared, fixed values Identical on every router, so one edit changes all System IP, site ID: Variable Unique per router or per site Transport address and gateway: Variable Different at every site Colour: Fixed per transport type, in a transport template or profile Tied to the kind of circuit, not the site A one-off feature at a single site: CLI add-on, with a note why Keeps the shared part cleanSettingPlace itReasonNTP, logging, bannerShared, fixed valuesIdentical on every router, so oneedit changes allSystem IP, site IDVariableUnique per router or per siteTransport address andgatewayVariableDifferent at every siteColourFixed per transport type, in atransport template or profileTied to the kind of circuit, not thesiteA one-off feature at asingle siteCLI add-on, with a note whyKeeps the shared part clean

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

Mistakes with templates and groups

  • Editing the router by hand and expecting the change to survive the next push.
  • Changing a shared template without checking how many devices are attached. One edit reaches all of them.
  • Mixing both methods on the same router. Use one, and check your release for what happens on a switch of method.
  • Leaving a variable blank or wrong and finding out only when the push fails.
  • Pushing a transport change to a remote site without a way back in.

Test yourself on configuration delivery

Predict · scenario 1

The NTP server for all branches changes. Where should the new address be edited?

Predict · scenario 2

Which statement about configuration groups is correct?

Predict · scenario 3

A template push changes the address on the only transport interface of a remote router. The router drops off the Manager. What is the most likely reason?

Predict · scenario 4

Which setting is the best candidate for a variable rather than a fixed value in a shared template?

FAQ

Which should a new deployment use, templates or configuration groups?
Configuration groups are the newer method, but what is supported depends on the release and on the router model, and existing networks often still use classic templates. Check your release's guide, and avoid managing the same router with both methods at once.
Can I still configure a router on its command line?
Yes, but a router managed by the Manager can have its configuration replaced when a template or group is pushed. Changes made on the command line may be lost or may block the push. Release dependent, so check how your version treats local edits.
Why use variables instead of one template per router?
One template per router means a change to a shared setting has to be repeated everywhere. With variables, the shared setting is changed once, and each router keeps its own values for the parts that differ.