: Perform Initial Configuration of the Panorama Virtual Appliance
Focus
Focus

Perform Initial Configuration of the Panorama Virtual Appliance

Table of Contents

Perform Initial Configuration of the Panorama Virtual Appliance

Based on your Panorama model, use the AWS, Azure, or GCP web interface, KVM Virtual Machine Manager, Hyper-V Manager, VMware vSphere Client, or vCloud Air web console to set up network access to the Panorama virtual appliance. By default, the Panorama virtual appliance is deployed in Panorama mode. For unified reporting, consider using Greenwich Mean Time (GMT) or Coordinated Universal Time (UTC) as the uniform time zone across Panorama and all the managed firewalls and Log Collectors.
  1. Gather the required information from your network administrator.
    Collect the following information for the management (MGT) interface:
    • IP address for the management (MGT) interface
      The default management interface IP address is 192.168.1.1. if you do not configure the management interface as described when you install the Panorama virtual appliance.
    • Netmask
    • Default gateway
    • DNS server IP address
      To complete the configuration of the MGT interface, you must specify the IP address, netmask (for IPv4) or prefix length (for IPv6), and default gateway. If you omit settings (such as the default gateway), you can access Panorama only through the console port for future configuration changes. As a best practice, always commit a complete MGT interface configuration.
  2. Access the console of the Panorama virtual appliance.
    1. Access the console.
      On an ESXi server:
      1. Launch the VMware vSphere Client.
      2. Select the
        Console
        tab for the Panorama virtual appliance and press enter to access the login screen.
      On vCloud Air:
      1. Access the vCloud Air web console and select your
        Virtual Private Cloud OnDemand
        region.
      2. Select the
        Virtual Machines
        tab, right-click the Panorama virtual machine, and select
        Open In Console
        .
    2. Enter your username and password to log in (default is admin for both).
      On AWS, Azure, GCP, KVM, and Hyper-V:
  3. Configure the network access settings for the MGT interface.
    Panorama uses the MGT interface for management traffic, high availability synchronization, log collection, and communication within Collector Groups.
    Starting with PAN-OS 9.0.4, the default
    admin
    credentials are no longer supported. When you first install the Panorama virtual appliance, you are required to log in to the Panorama CLI to configure a unique
    admin
    password.
    If this is the first time you are logging in to the Panorama CLI, you are prompted to enter the
    Old Password
    and the
    New Password
    for the
    admin
    user before you can continue with the initial configuration of the Panorama virtual appliance.
    1. Enter the following commands, where
      <Panorama-IP>
      is the IP address you want to assign to the Panorama management interface,
      <netmask>
      is the subnet mask,
      <gateway-IP>
      is the IP address of the network gateway, and
      <DNS-IP>
      is the IP address of the DNS server:
      >
      configure
      #
      set deviceconfig system ip-address
      <Panorama-IP>
      netmask
      <netmask>
      default-gateway
      <gateway-IP>
      dns-setting servers primary
      <DNS-IP>
      #
      commit
      #
      exit
    2. Troubleshoot Connectivity to Network Resources to verify network access to external services required for firewall management, such as the default gateway, DNS server, and the Palo Alto Networks Update Server, as shown in the following example:
  4. Configure the general settings.
    1. Using a secure connection (HTTPS) from a web browser, log in to the Panorama web interface using the IP address and password you assigned to the management interface (https://<IP address>).
    2. Select
      Panorama
      Setup
      Management
      and edit the General Settings.
    3. Enter a
      Hostname
      for the server and enter the network
      Domain
      name. The domain name is just a label; Panorama doesn’t use it to join the domain.
    4. Align the clock on Panorama and the managed firewalls to use the same
      Time Zone
      , for example GMT or UTC. If you plan to use the
      Cortex Data Lake
      , you must configure NTP so that Panorama can stay in sync with the
      Cortex Data Lake
      .
      Timestamps are recorded when Panorama receives the logs and the managed firewalls generate the logs. Aligning the time zones on Panorama and the firewalls ensures that the timestamps are synchronized and the process of querying logs and generating reports on Panorama is harmonious.
    5. Enter the
      Latitude
      and
      Longitude
      to enable accurate placement of the Panorama management server on the world map.
    6. Enter the
      Serial Number
      you received in the order fulfillment email.
    7. Click
      OK
      to save your changes.
  5. (
    Optional
    ) Modify the management interface settings.
    To configure connectivity to Panorama using an IPv6 IP address, you must configure both an IPv4 and IPv6 to successfully configure Panorama using an IPv6 IP address. Panorama does not support configuring the management interface with only an IPv6 IP address.
    1. Select
      Panorama
      Setup
      Interfaces
      and click
      Management
      .
    2. If your firewalls connect to the Panorama management server using a public IP address that is translated to a private IP address (NAT), enter the public IP in the
      Public IP Address
      field, and the private IP in the
      IP Address
      field to push both addresses to your firewalls.
    3. Select which Network Connectivity Services to allow on the interface (such as
      SSH
      access).
      Don’t select
      Telnet
      or
      HTTP
      . These services use plaintext and are less secure than the other services.
    4. Click
      OK
      to save your changes to the interface.
  6. Commit your configuration changes.
    Select
    Commit
    Commit to Panorama
    and
    Commit
    your changes.

Recommended For You