Create a Device Onboarding Rule

Create a Device Onboarding Rule

1. Log in to Strata Cloud Manager.
2. Select WorkflowsNGFW SetupDevice Onboarding.
3. Add Rule.
4. Configure the General device onboarding rule settings.

   1. The device onboarding rule is Enabled by default. Toggle the Enable setting to disable the onboarding rule after you Save.
   2. Enter a descriptive Name for the onboarding rule.
   3. (Optional) Enter a Description for the onboarding rule.
5. Define the onboarding rule Match Criteria.

   The match criteria define to which Palo Alto Networks NGFW the device onboarding rule applies.

   1. Specify which Palo Alto Networks NGFW Models.

      • Any—Applies to all Palo Alto Networks NGFW onboarded to Strata Cloud Manager.
      • Match—Inclusive condition that applies to the Palo Alto Networks NGFW models added to the match list. You can select one or multiple different Palo Alto Networks NGFW models.
        For example, if you add PA-1410 and PA-3260, then the onboarding rule Action applies only to those Palo Alto Networks NGFW.
      • Exclude (Negate)—Exclusive condition that applies to all Palo Alto Networks NGFW models not added to the exclude match list.
        For example, if you add PA-1410 and PA-3260, then the onboarding rule Action applies to all Palo Alto Networks NGFW models except for those added to the exclude list.
   2. Specify the Device S/N.

      This compliments the Models match criteria by allowing you to identify specific serial numbers of Palo Alto Networks NGFW Models that the onboarding rule applies to.

      • Any—Applies to all Palo Alto Networks NGFW serial numbers.
      • Match—Enter a regular expression (regex) to identify Palo Alto Networks NGFW serial numbers.
   3. Specify Labels applied to Palo Alto Networks NGFW during onboarding that the onboarding rule applies to.

      You can use And, Or, and Not operators to write a logical expression of labels to match. You can use parentheses (()) to group sets of labels and logical operators when writing your regular expression.

   
6. Define the onboarding rule Action.

   1. Select the Target Folder the firewall is added to if it matches the device onboarding rule.

      If no Target Folder is specified, then the firewall is added to the default All Firewalls folder.

      (VM-Series, funded with Software NGFW Credits) You can configure the dgname field in the init.cfg.txt bootstrap parameters to add the VM-Series firewall to a target folder. In this case, Strata Cloud Manager prioritizes adding the VM-Series firewall to the target folder configured in the init.cfg.txt file over the one configured in the device onboarding rule.
   2. For Snippet Association, apply snippet configuration to the onboarded firewall after it successfully connects to Strata Cloud Manager.

      Snippets are a tool used to standardize a common base configuration for a set of firewalls or deployments. This allows you to quickly onboard a new firewall with a known good configuration and reduces the time required to onboard a new firewall.

      

   3. Enable VPN Onboarding if you have configured Auto VPN for secure hub-and-spoke connectivity between Strata Cloud Manager and your managed firewalls.

      If enabled, select the VPN Cluster to add the firewall to. This determines the gateway devices and automatically creates secure connections between the configured gateway and the newly onboarded firewall.

      Click Configure to configure the Palo Alto Networks NGFW as a hub or branch firewall.

      

   4. Enable User Context Onboarding to configure the user and tag mappings required for User Context for Cloud Identity Engine (CIE).

      User Context provides simplified granular control over the data that is shared across your security devices. It provides your administrators the flexibility to specify the data types each device sends and receives.

      If enabled, you must configure the Segments to Contribute Data To to customize the segment mappings the firewall sends to CIE and the Segments to Receive Data From to customize how CIE provides segment mappings to the firewall.

      
7. Save.
8. In Device Onboarding, review your newly configured onboarding rule and verify it's Enabled.

   Device onboarding rules are processed in a top-down priority. Strata Cloud Manager evaluates each onboarding rule Match Criteria starting with the rule highest in the rule hierarchy until the Palo Alto Networks NGFW meets all Match Criteria. Strata Cloud Manager then takes the Action specified in the matching rule. In the event two rules in the device onboarding rule hierarchy apply to the same firewall, Strata Cloud Manager takes the Action configured in the device onboarding rule higher up in the rule hierarchy.
9. Onboard your Palo Alto Networks NGFW manually or using Zero Touching Provisioning (ZTP).