>
    Strata Copilot
    Update your Panorama Registration
    Focus
    Download PDF
    Focus
    1. Home
    2. Cloud NGFW for Azure Administration
    3. Protect Traffic with Cloud NGFW for Azure
    4. Panorama Policy Management
    5. Update your Panorama Registration
    Download PDF
    Cloud NGFW for Azure

    Update your Panorama Registration

    Table of Contents

    Update your Panorama Registration

    Learn how to simplify your Cloud NGFW for Azure Panorama deployment.
    Where Can I Use This?What Do I Need?
    • Cloud NGFW for Azure
    • Cloud NGFW subscription
    • Palo Alto Networks Customer Support Portal account
    • Azure Marketplace subscription
    You can modify the Panorama parameters after you have registered the Cloud NGFW with Panorama. You generate a new registration string in Panorama and update your Cloud NGFW resource when you make the following changes:
    1. Migrate a Cloud NGFW resource from one Panorama to another Panorama.
    2. Add a log collector to Panorama after deploying the Cloud NGFW resource.
    3. Move the Cloud NGFW to a different cloud device group.
    4. Modify the Panorama IP address after deploying the Cloud NGFW resource.
    Consider the following:
    • The update process involves a rolling upgrade. During this time there is a brief period where some Cloud NGFW resources may be connected to an older Panorama instance while other resources are connected to a new one. This process ensures continuous protection to all Cloud NGFW resources.
    • Palo Alto Networks recommends that you don’t push any configuration changes in Panorama to ensure consistency across all Cloud NGFW resources during the update process.
    • The feature currently supports updates to the Panorama IP address, a cloud device group, a template stack, or a log collector.
    • The update process may take long for deployments containing a large number of firewall instances to ensure thorough validation and a smooth transition.
    When a Cloud NGFW for Azure instance is scaled in, a 72-hour grace period begins before the device is removed from Panorama.
    Requirements
    To simplify onboarding with your Cloud NGFW resource, you’ll need the following:
    • Panorama versions 10.2, 11.0, 11.1, 11.2 or later.
    • Azure plugin for Cloud NGFW version 5.2.2 or greater.

    Generate a New Registration String

    You’ll need to generate a new Panorama registration string from your Panorama instance to update your Panorama registration in the Azure Portal by following these steps:
    1. Log into Panorama.
    2. Select the Panorama tab in the upper portion of the web interface.
    3. In the Azure plugin section, select Cloud NGFW. Previously created Cloud Device Groups appear if they were established for the Cloud NGFW resource using Azure.
    4. Select the Cloud Device Group and make any necessary changes.
    5. Click Generate to display the registration string, then commit your changes.
    6. In the Registration String screen, click Copy Registration String.
    7. Log in to the Azure Portal.
    8. Select the Cloud NGFW, then navigate to Settings > Security Policies to update the generated configuration string.
      The system automatically processes the update then creates a dry-run instance to validate the changes before applying them to your firewall instances through a rolling upgrade process.
      If the dry-run process fails:
      • Changes revert to the previous configuration, and any scale-out picks up the previous configuration.
      • The Panorama web interface indicates that Health Status is Degraded, and the Provision Status indicates a Accepted or Succeeded.
      If the dry run succeeds, the rolling upgrade process for the existing firewall begins:
      • The Health Status appears as Healthy.
      • Incremental firewall resources are picked up by the rolling upgrade process; with 20% of the resources updated. The remaining 80% continue to process traffic.
      • If any failures occur during the rolling upgrade process, the Palo Alto Networks support team is alerted.
      The following table illustrates the states associated with the Health Status:
      Config String UpdateProvision StateHealth StatusHealth Reason
      AcceptedDegraded
      • Config string verification failed - not able to connect to Panorama
      • Unable to apply config string to FW - not able to connect to Panorama
      SucceededHealthyConfig string successfully applied

    Migrate a Panorama Instance

    Use this procedure to migrate one Panorama instance to another Panorama:
    1. Log in to your first Panorama instance.
    2. Select Panorama>Setup>Operations and click Save named Panorama configuration snapshot.
    3. Select Panorama>Setup>Operations and click Export named Panorama configuration snapshot. Save the file with a .XML extension.
    4. Log in to your second Panorama instance.
    5. Select Panorama>Setup>Operations and click Import named Panorama configuration snapshot; load the file you previously created in step 3.
    6. Select Panorama>Setup>Operations and click Load named Panorama configuration snapshot.
    7. Generate the registration string and update the existing firewall.

    © 2025 Palo Alto Networks, Inc. All rights reserved.