Migrate a Firewall to Panorama Management and Push a New Configuration

Plan the migration.
See the checklist in Plan the Transition to Panorama Management.
Add the firewall as a managed device.
See Add a Firewall as a Managed Device for more information on adding a firewall to Panorama management.
Log in to the Panorama Web Interface
Select
Panorama
Device Registration Auth Key
and
Add
a new authentication key.
Copy Auth Key
after you successfully create the device registration authentication key.
Select
Panorama
Managed Devices
Summary
to
Add
a firewall as a managed device.
Enter the serial number of the firewall and click
OK
.
To add multiple firewalls at the same time, enter the serial number of each one on a separate line.
Select
Commit
Commit to Panorama
and
Commit
your changes.
Set up a connection from the firewall to Panorama.
Log in to the firewall web interface
Select
Device
Setup
Management
and edit the Panorama Settings.
In the
Panorama Servers
fields, enter the IP addresses of the Panorama management server.
Paste the
Auth Key
you copied in the previous step.
Click
OK
and
Commit
.
On the Panorama web interface, select
Panorama
Managed Devices
Summary
and verify that the
Device State
is
Connected
.
Add a Device Group.
Repeat this step to create as many device groups as needed to logically group your firewall configurations. Device groups are required to manage device group objects and policies. Learn more about how to manage your device groups.
Create a template and template stack.
Templates and template stacks are used to configure the firewall
Network
and
Device
settings that enable firewall to operate on the network.
Add a Template.
Repeat this step to create as many templates as needed to define your required networking configurations.
Configure a Template Stack.
Repeat this step to create as many template stacks as needed to quickly apply your defined networking configurations. When you create a template stack, assign the relevant templates and managed firewalls.
Configure the device groups, templates, and template stacks as needed.
Push the device group and template configurations to complete the transition to centralized management.
Select
Commit
Commit and Push
.
(
Optional
) Click
Edit Selections
to modify the Push Scope.
Merge with Device Candidate Config
—This setting is enabled by default and merges any pending local firewall configurations with the configuration push from Panorama. The local firewall configuration is merged and committed regardless of the admin pushing the changes from Panorama or the admin who made the local firewall configuration changes.
Disable this setting if you manage and commit local firewall configuration changes independently of the Panorama managed configuration.
Force Template Values
—Overwrites any local firewall configurations with those in the template stack configuration pushed from Panorama in the event of conflicting values.
This setting is enabled by default. Enable this setting to overwrite any conflicting firewall configurations with those defined in the template or template stack. Before enabling this setting, review any overridden values to ensure an outage does not occur.
Click
OK
to save your changes to the Push Scope.
Commit and Push
your changes.
Select
Panorama
Managed Devices
Summary
and verify that the
Shared Policy
and
Template
status is
In Sync
for the newly added firewalls.
On the firewall web interface, verify that configuration objects display a green cog, signifying that the configuration object is pushed from Panorama.
Perform your post-migration test plan.
Perform the verification tasks that you devised during the migration planning to confirm that the firewalls work as efficiently with the Panorama-pushed configuration as they did with their original local configuration: see Create a post-migration test plan.