Extending templates
In the previous chapters, we have built a project foundation covering the most common configuration of SD-WAN nodes. But in a real-world deployment, there will likely be additional features that need to be configured at least on some of the sites. Think of an additional IPsec tunnel to an external location, a routing adjacency with an existing Customer's router, or generally speaking any functionality supported by the FortiGate, but not directly related to the SD-WAN solution.
According to the principles that we are following throughout this document, all this functionality must be templated too, to avoid per-device configuration and keep the entire deployment workflow generic, reusable, and traceable.
How should we template this additional configuration, without interfering with the foundation built so far?
To answer this question, we must distinguish between two cases:
-
When the additional configuration can be templated using one of the existing GUI-based **Provisioning Templates**, the answer is straightforward. You can simply create the additional templates (for example, an IPSEC Template, a BGP Template and so on) and add them to the existing Template Groups. If necessary, a separate Template Group can be created for a new subset of SD-WAN nodes and selected in their respective Device Blueprints.
The same is true for all the functionality implemented in the Firewall Policy. Any supported object can be simply added to the respective Policy Package, even if it was not covered in the previous chapters.
-
When none of the GUI-based Provisioning Templates and/or Firewall Policy objects is enough to template the desired configuration, then you can create a CLI Template. The next sections outline our recommended approach to combining your custom CLI Templates with the Jinja Orchestrator.