About Panorama Plugins
Panorama supports integrations with these services through
the extensible plugin architecture.
Panorama supports an extensible plugin architecture
that enables the integration and configuration of the following
capabilities:
CloudConnector—The CloudConnector Plugin for Panorama enables you to
proactively enforce best practice
checks by validating your commits and letting you know if a policy
needs work before you push it to Panorama.
AWS—The AWS plugin enables you to monitor your EC2
workloads
on AWS. With the plugin, you can enable
communication between Panorama (running PAN-OS 8.1.3 or a later
release) and your AWS VPCs so that Panorama can collect a predefined
set of attributes (or metadata elements)
as tags for your EC2 instances and register the information to your
Palo Alto Networks firewalls. When you reference these tags in
Dynamic Address Groups and
match against them in Security policy rules, you can consistently
enforce policy across all assets deployed within your VPCs.
Azure—The Azure plugin enables you to monitor your
virtual machines on the
Azure public cloud. With the plugin, you
can enable communication between Panorama (running PAN-OS 8.1.6
or a later release) and your Azure subscriptions so that Panorama
can collect a predefined
set of attributes (or metadata elements)
as tags for your Azure virtual machines and register the information
to your Palo Alto Networks firewalls. When you reference these tags
in
Dynamic Address Groups and
match against them in Security policy rules, you can consistently
enforce policy across all assets deployed within VNets in your subscriptions.
Cisco ACI—The Cisco ACI plugin enables you to monitor
endpoints in your
Cisco ACI fabric. With
the plugin, you enable communication between Panorama (8.1.6 and
later) and your Cisco APIC so that Panorama can collect endpoint
information as tags for your Endpoint Groups and register the information
to you Palo Alto Networks firewalls. When you reference these tags
in Dynamic Address Groups and match against them in Security policy
rules, you can consistently enforce policy across all assets deployed
within your Cisco ACI fabric.
Cisco TrustSec—The
Cisco TrustSec Plugin enables
monitoring of endpoints in your Cisco TrustSec environment. With
the plugin, you enable communication between Panorama and your Cisco
pxGrid server so that Panorama can collect endpoint information
as tags for your endpoints and register the information to you Palo
Alto Networks firewalls. When you reference these tags in Dynamic
Address Groups and match against them in security policy rules,
you can consistently enforce policy across all assets deployed within
your Cisco TrustSec environment.
Cloud Services—The Cloud Services plugin enables the use of the
Strata Logging Service and
Prisma Access. The
Strata Logging Service solves operational logging challenges and the
Prisma Access cloud service extends your security infrastructure to your
remote network locations and mobile workforce.
Enterprise Data Loss Prevention (DLP)—
Enterprise DLP is a set
of tools and processes that allow you to protect sensitive information
against unauthorized access, misuse, extraction, or sharing. Enterprise
DLP is enabled through a cloud service to help you inspect content
and analyze the data in the correct context so that you can accurately
identify sensitive data and secure it to prevent incidents. Enterprise
DLP is supported on Panorama and managed firewalls running PAN-OS
10.0.2 and later releases.
GCP—Enables you to
secure Kubernetes services in
a Google Kubernetes Engine (GKE) cluster. Configure the Panorama
plugin for Google Cloud Platform (GCP) to connect to your GKE cluster
and learn about the services that are exposed to the internet.
Network Discovery—The Network Discovery plugin enables you to learn more about
devices in your network, by using SNMP querying or by polling devices. You can use SNMP
to traverse the network by querying switches, or you can actively poll devices that use
certain industrial OT protocols.
Nutanix—The Panorama plugin for Nutanix enables VM
monitoring in your Nutanix environment. It allows you to track the
virtual machine inventory within your Nutanix Prism Central so that
you can consistently enforce security policy that automatically
adapts to changes within your Nutanix environment. As virtual machines
are provisioned, de-provisioned or moved, this solution allows you
to collect the IP addresses and associated sets of attributes (or
metadata elements) as tags. You can then use the tags to define
Dynamic Address Groups and
use them in Security policy. The Panorama plugin for Nutanix requires
Panorama 9.0.4 or later.
SD-WAN—The
Software-Defined Wide Area Network (SD-WAN)
plugin allows you to use multiple internet and private services
to create an intelligent and dynamic WAN, which helps lower costs
and maximize application quality and usability. Instead of using
costly and time-consuming MPLS with components such as routers, firewalls,
WAN path controllers, and WAN optimizers to connect your WAN to
the internet, SD-WAN on a Palo Alto Networks firewall allows you
to use less expensive internet services and fewer pieces of equipment.
VMware NSX—The VMware NSX plugin enables integration
between the
VM-Series firewall on VMware
NSX with VMware NSX Manager. This integration allows you
to deploy the VM-Series firewall as a service on a cluster of ESXi
servers.
VMware vCenter—The Panorama plugin for VMware vCenter
allows you to monitor the virtual machines in your
vCenter environment. The
plugin retrieves IP addresses of virtual machines in your vCenter
environment and converts them to tags that you can use to build
policy using dynamic address groups.
Zero Touch Provisioning—
Zero Touch Provisioning
(ZTP) is designed to simplify and automate the on-boarding
of new firewalls to Panorama. ZTP streamlines the initial firewall
deployment process by allowing network administrators to ship managed
firewalls directly to their branches and automatically add the firewall to
Panorama, allowing business to save on time and resources when deploying
new firewalls. ZTP is supported on PAN-OS 9.1.3 and later releases.
Not
supported on Panorama in FIPS-CC mode.
IPS Signature Converter—The
IPS Signature Converter plugin for
Panorama provides an automated solution for converting rules from third-party
intrusion prevention systems—Snort and Suricata—into custom Palo
Alto Networks threat signatures. You can then register these signatures
on firewalls that belong to device groups you specify and use them
to enforce policy in Vulnerability Protection and Anti-Spyware Security
Profiles.
As of September 1, 2025 the Panorama Interconnect
Plugin is no longer supported. For additional information regarding this change
and alternatives, see the
official end of life notice.
You can install multiple plugins and retrieve IP address updates
from multiple sources on a single Panorama instance. This allows
you to create and enforce consistent security policy to secure applications
and workloads across multiple cloud environments. Retrieved IP addresses
are used in security policy through
dynamic address groups;
when a workload is added or removed from your environment, Panorama
registers the change and pushes the update to the firewalls. When
deploying multiple plugins on Panorama, you must carefully plan
your
device group hierarchy to
ensure that updates are passed to your firewalls correctly.
