Orchestration, Automation, and Management
Orchestrator role
Orchestrator is the central management platform: it stores configuration, pushes it to appliances, manages software images, licenses, and templates, and provides a single pane of glass. It is not in the data path. Appliance-to-Orchestrator connectivity is required for configuration changes but not for continued forwarding, a frequently tested distinction.
Templates and automation
Configuration is delivered through templates (group and device level) so common settings apply to many sites while device-specific values (IPs, hostnames) are overridden locally. Groups organize appliances for policy and template application; a device in the wrong group receives the wrong template. Zero-touch provisioning lets a new appliance phone home to Orchestrator and receive its identity and config automatically, which requires correct DNS/registration and pre-staged device records. APIs allow automation of configuration and monitoring; know that API changes follow the same validation as GUI changes.
Operations
Software upgrades are orchestrated and can be scheduled; backups of configuration should be taken before changes. Role-based access control separates operators. Traps: assuming a template change applies instantly (it must be pushed), editing device-level overrides that conflict with group templates, and assuming ZTP works without a pre-existing device entry or reachable Orchestrator.
Rule of thumb
Change at the highest level that is common: group template for shared policy, device override only for unique values. Worked example: 200 branches share a BIO and firewall policy in a group template; each device overrides only its WAN IPs and hostname. A new branch is pre-staged in Orchestrator, shipped, and ZTP pulls the group template on first boot.