Configure NGFW Connector Integration (Panorama)

1. Prepare templates and device groups in Panorama.

   1. Select PanoramaTemplatesCreate Templates and create a template.
   2. On Panorama, select TemplatesAdd Stack and create a new template stack. If required, create or modify the template variables.
   3. On Panorama, select Device GroupAdd and add a device group for your NGFW and attach the template created to the device group.
      If managing multiple NGFWs with the same template, use variables for unique configurations, such as WAN IP and LAN IP.

   4. On Panorama, select Device Registration Auth KeyAdd and add a device registration authentication key. Select Copy Auth Key and Close.
   5. On Panorama, select Managed DevicesSummaryAdd, enter the device registration key you created, select Generate Auth Key, and Commit and Push.
   6. Configure the Panorama settings for the firewall.
      1. Select DeviceSetupManagement and edit the Panorama Settings.
      2. Enter the Panorama IP address in the first field.
      3. Enter the Auth key, select OK, and Commit your changes.
   7. On Panorama, select Managed DevicesSummary and verify the connection status.

2. Configure the WAN and LAN interfaces within your Panorama template.

   1. On Panorama, select NetworkInterfacesEthernet, select the appropriate template from the Template context drop-down, select a slot number, such as Slot1, and select an interface (for example, ethernet1/1). Select the Interface Type as Layer 3.
   2. On the Config tab, select a Virtual Router or create a new virtual router.

   3. Assign the Security Zone that is appropriate for the interface you're configuring.
   4. For an IPv4 interface, select IPv4 tab and select Static in the Type of address field. Select Add to add a WAN IP address.
   5. On the Advanced tab, create or attach a Management Profile. Enable PoE Enable, and select OK.

   6. On Panorama, select NetworkZones and create a Zone. Add a Name and select the Type as Layer 3. Enable Packet Buffer Protection under Zone Protection and select OK.

   7. Create a Virtual Router.
      1. On Panorama, select NetworkVirtual Routers and select the virtual router.

      2. Select Router SettingsInterfaces. In Static Routes tab, select default.
      3. (Optional) Configure BGP. If not configured, Prisma Access Service enables it when the Connector is onboarded.
      4. Select OK.
   8. Commit and Push to save the configuration.
3. Connect your Prisma Access tenant to Panorama.

   1. On Panorama, select Cloud ServicesConfigurationNGFW Connector and select the settings icon.
   2. Add Prisma Access TSG ID.

   3. Configure the Service Account credentials.
      1. Create a Service Account in Strata Cloud Manager under Identity & Access Management.
      2. Get the Client Secret for this Service Account.
      3. On Panorama, add this Client Secret.
      4. On Strata Cloud Manager, select ConfigurationZTNA ConnectorOverview. Under NGFW Connector, copy the secret Key.

      5. Commit and Push to initiate the connection to Prisma Access.
      6. Verify the connection status on Panorama.

4. Onboard the NGFW as an unclaimed connector.

   1. In Panorama, select Cloud ServicesConfigurationNGFW Connector and select Add.
   2. Add NGFW Connector details.
      1. Enter a descriptive Name for NGFW Connector.
      2. Choose the Template Stack and Template that manages this NGFW.
      3. Select the specific NGFW Device (identified by its serial number) from the dropdown list.
      4. Add a routable Loopback IP address for the NGFW.
      5. Select the WAN interface configured earlier in the prerequisites.

   3. Commit the changes from Panorama to NGFW and verify the NGFW Connector registration. You can see the NGFW's public IP address.
5. (Optional) Configure DNS for private applications.

   Use this procedure only if you don't have a private DNS server capable of resolving your internal applications and choose to use Panorama's DNS Proxy for static entries or wildcard resolution.

   1. Select the proxy object in Panorama.
      1. In Panorama, select DeviceSetupServices and then select the proxy object (for example, ztna_ngfw_proxy).

      2. Under DNS Settings, select the DNS Proxy Object, and then select ztna_ngfw_proxy.
   2. Select NetworkDNS Proxy and add DNS Static Entries for your private applications. Map application FQDNs to their corresponding IP addresses and select OK.

   3. Commit to save the DNS Proxy configuration and changes to Panorama.

   (Optional) Configure a DNS server for private applications if you want to use a DNS server to resolve internal applications.

   1. In Panorama, select TemplatesDeviceSetupServices and select the settings icon.
   2. Under DNS Settings, select Servers, add a Primary DNS Server, and a Secondary DNS Server.

   When an NGFW Connector is onboarded, Prisma Access service configures ztna_ngfw_proxy in NetworkDNS Proxy. If DNS server is configured, then ztna_ngfw_proxy uses the same DNS IP addresses.