CN-Series Deployment Checklist

If you have not done so already, License the CN-Series Firewall—generate your authorization code and have it on hand when you are ready to deploy the CN-Series firewall.
Review the CN-Series Prerequisites—before you begin your deployment, make sure you understand the system requirements needed to deploy the CN-Series firewall.
Prepare the components.
Generate a VM Auth Key on Panorama.
(
Optional
) Generate the Auto-Registration PIN for the CN-Series.
Create Service Accounts for Cluster Authentication.
Deploy Panorama—you must use Panorama to configure, deploy, and manage your CN-Series firewall deployment. For more information about deploying and setting up a Panorama appliance, see Set Up Panorama.
Install the Kubernetes Plugin and Set up Panorama for CN-Series.
Get the Images and Files for the CN-Series Deployment—access the Palo Alto Network Customer Support Portal to download the Docker files and GitHub to get the yaml files required to deploy the CN-Series firewall in your Kubernetes environment.
Deploy the CN-Series firewall.
Edit the yaml files to fit your deployment—review the Editable Parameters in CN-Series Deployment YAML Files before your deploy the CN-Series firewall. Many of the parameters set in the yaml files must be modified to successfully deploy the CN-Series firewall.
Deploy the CN-Series Firewall as a Kubernetes Service.
Deploy the CN-Series Firewall as a DaemonSet.
(
Optional
) If you are deploying your CN-Series firewall as a Kubernetes service, you can Enable Horizontal Pod Autoscaling on the CN-Series. Horizontal Pod Autoscaling (HPA) allows your CN-Series firewall deployment to autoscale dynamically along with your Kubernetes environment.
If you are deploying your CN-Series in a OpenShift environment, see Deploy the CN-Series on OpenShift.
If you are securing 5G traffic with your CN-Series firewall, see Secure 5G With the CN-Series Firewall.
Configure Panorama to Secure a Kubernetes Deployment—after you have deployed your CN-Series firewall, use Panorama to configure security policies that enable traffic enforcement and push those policies to the firewall.