Template Strategy for a Mixed Hardware Refresh
A retail chain is standardizing 240 stores on Cisco SD-WAN after years of per-site CLI templates. Half the stores have ISR4331 routers and half have C8300-1N1S-6T; interface naming differs (GigabitEthernet0/0 versus GigabitEthernet0/0/0). Every store has MPLS and internet; 60 stores are dual-router HA pairs, 180 are single-router. Internet WAN uses DHCP; MPLS uses static /30 addresses. Each store needs a unique BGP AS number and unique IPsec pre-shared key. The team wants to use feature and device templates, but change control requires that any template update be deployable to all 240 stores without an outage and with an auditable diff. The migration window is six weeks, and the team has limited vManage template experience.
1. How would you structure feature templates, device templates, and variables for two router models and two HA roles?
Read the worked answer
Do not use one CLI template per site; that recreates the drift you are trying to eliminate. Build feature templates per platform where the CLI differs-ISR4331 and C8300-covering system, VPN 0, VPN 1, BGP, IPsec, and LAN/WAN interfaces. Keep shared policy in common feature templates only where the CLI is identical. Build four device templates: ISR single, ISR HA, C8300 single, C8300 HA. Each device template references the correct platform feature templates, so interface naming is solved by template selection, not by variables.
Use variables at three levels. System variables cover hostname, system IP, site ID, and port. Device-specific variables cover BGP AS and IPsec pre-shared key. Common variables cover NTP, DNS, and syslog. In HA templates, variables must be per device; do not use one value for both chassis. For BGP AS, document the allowed range and validate the CSV before import. For the PSK, use a secure variable and avoid exporting it. This gives one template per model/role while keeping per-store uniqueness in the CSV.
2. How do you handle unique per-site values and HA pairs without duplicating templates?
Read the worked answer
Use a CSV with one row per device and map each unique value to a device-specific variable. A dual-router HA pair is one device template with two device entries, not two separate templates. The system IP, BGP AS, and PSK variables must be device-specific; if you make them common, both routers receive the same value and the HA pair breaks. For BGP, verify that no two stores use the same AS if the MPLS provider treats them as separate domains; for IPsec, ensure the PSK matches the peer but differs per tunnel.
Keep the variable CSV under version control and validate it against a test vManage before production. Use default values only for safe, non-unique settings. For interface differences, use platform-specific feature templates rather than conditional CLI. If the C8300 has different port layouts, create a C8300 interface feature template and attach it only to C8300 device templates. This avoids CLI add-ons that would bypass variable validation.
3. What rollout and change-control approach minimizes outage risk in six weeks?
Read the worked answer
Use vManage configuration change control with an approval step and an attached configuration diff. Pilot one ISR single, one ISR HA, one C8300 single, and one C8300 HA. Compare the generated configuration before activation, not after. Schedule changes in maintenance windows and avoid changing WAN IP addresses or TLOC attributes during business hours. Roll out by model/role cohort, not by all 240 at once.
For template updates, use the diff view to confirm only intended lines change. If a change touches WAN interfaces or control connections, stage it on a pilot first and verify control connections, BFD, and OMP for at least an hour. Keep a rollback plan: the previous template version and the device configuration backup. Do not combine a template change with a software upgrade. Finally, audit drift after each cohort so the six-week window does not become a new set of per-site exceptions.