Use the Panorama CloudConnector plugin to analyze Panorama configurations in Strata
Cloud Manager Policy Optimizer, Config Cleanup, and Policy Analyzer.
| Where Can I Use This? | What Do I Need? |
|---|
|
|
- AIOps for NGFW Premium or Strata Cloud Manager Pro for premium features such as Policy Optimizer
and Policy Analyzer
- Panorama running PAN-OS 10.2.3 or a later release
- Panorama onboarded to Strata Cloud Manager and associated
with a tenant service group (TSG)
- Strata Logging Service enabled for your firewalls,
with the correct region and product usage configuration, for
Policy Optimizer, Config Cleanup, and Zero Trust Posture
Center
|
If you manage your firewalls with Panorama, you don't need to move them to Strata
Cloud Manager to use Strata Cloud Manager security posture features. The Panorama
CloudConnector plugin connects your Panorama to Strata Cloud Manager so that you can
analyze and improve your Panorama configuration from the cloud while you continue to
manage your firewalls from Panorama.
With Panorama CloudConnector plugin 3.0.0 or later, Panorama sends its configuration
to Strata Cloud Manager every time you commit, so Strata Cloud Manager always
analyzes your current configuration. When you accept a recommendation, Strata Cloud
Manager sends the change to the candidate configuration on Panorama—it never changes
your firewalls directly. You review and commit the change in Panorama, and then push
it to your firewalls.
- No inbound connectivity—Strata Cloud Manager sends changes through an
asynchronous communication framework, so you don't need direct network
connectivity from the cloud to your on-premises Panorama. Panorama records the
changes under the administrator name __cloudconnector.
- Status tracking—Strata Cloud Manager tracks every create, update, delete,
and multi-configure operation with a status such as Pending Review,
Updated to Candidate Config, or Error, so that you can see
what changed, when it was applied, and whether it succeeded.
- High availability (HA) pairs—Strata Cloud Manager treats each Panorama or
firewall HA pair as a single logical unit, so you don't see duplicate results,
and the results remain available after a failover.
The following table lists the Strata Cloud Manager features that you can use with
Panorama-managed firewalls and the plugin version that each feature requires.
Strata Cloud Manager Features for Panorama-Managed Firewalls
| Feature | What You Can Do | Minimum Plugin Version |
|---|
| Policy Optimizer |
Replace overly permissive Security policy rules with specific
rules that allow only the applications and users in use on your
network, based on your traffic logs. Policy Optimizer considers
both Cloud Identity Engine users and the users defined locally
in your Panorama templates.
The original rule stays in your policy below the optimized rules
so that you can monitor it and remove it when its traffic hits
reach zero.
| 3.0.0 |
| Config Cleanup | Find unused objects, zero hit objects, and zero hit policy rules
in your Panorama configuration, and then delete the objects or
enable, disable, or delete the rules you no longer need. | 3.0.0 |
| Zero Trust Posture Center
and Compliance Center | Get posture and compliance insights from the configuration that
Panorama sends at each commit, instead of the once-a-day
configuration that device telemetry sends. | 3.0.0 |
|
| Policy Analyzer | Check that a new Security policy rule meets your intent before
you commit it, and find shadows, redundancies, generalizations,
correlations, and consolidations in your existing rulebase. | 1.1.0 |
| Cloud NGFW for AWS | Write policies for device groups in Panorama and push them to
Cloud NGFW for AWS resources. Requires the Panorama AWS plugin 5.0.0
or later. | 2.0.0 |
Complete the following steps to connect your Panorama to Strata Cloud Manager.
