Deploy NGFW-ZTNA Integration with Panorama Management

1. Prepare templates and device groups in Panorama.

   1. Select PanoramaTemplatesCreate Templates and create a template.
   2. On Panorama, select TemplatesAdd Stack and create a new template stack. If needed, create or modify the template variables.
   3. On Panorama, select Device GroupAdd and add a device group for your NGFW and attach the template created to the device group.
      If managing multiple NGFWs with the same template, use variables for unique configurations, such as WAN IP and LAN IP.
   4. Panorama, select Device Registration Auth KeyAdd and add a device registration authentication key. Select Copy Auth Key and Close.
   5. On Panorama, select Managed DevicesSummaryAdd, enter the device registration key you created. Select Generate Auth Key, and Commit and Push.
   6. In the firewall, select DeviceSetupManagement and edit the Panorama Settings.
   7. Enter the Panorama IP address in the first field.
   8. Enter the Auth key, select OK, and Commit your changes.
   9. On Panorama, select Managed DevicesSummary and verify the connection status.
2. Configure the WAN and LAN interfaces within your Panorama template.

   1. On Panorama, select Network > Interfaces > Ethernet, select the appropriate template from the Template context drop-down, select a slot number such as Slot1, and select an interface (for example, ethernet1/1). Select the Interface Type as Layer 3.
   2. On the Config tab, select a Virtual Router or create a new virtual router.
   3. Assign the Security Zone that is appropriate for the interface you're configuring.
   4. For an IPv4 interface, select the IPv4 tab and select Static in the Type of address field.Select Add to add a WAN IP address.
   5. On the Advanced tab, create or attach a Management Profile. Enable PoE Enable, and select OK.
   6. On Panorama, select NetworkZones and create a Zone. Add a Name and select theType as Layer 3. Enable Packet Buffer Protection under Zone Protection and select OK.
   7. On Panorama, select NetworkVirtual Routers and select the virtual router.
   8. Select Router SettingsInterfaces. In the Static Routes tab, select default.
   9. (Optional) ConfigureBGP. If not configured, Prisma Access Service enables it when theConnector is onboarded.
   10. Click Ok
   11. Commit and Push to save the configuration.
3. Connect your Prisma Access tenant to Panorama.

   1. On Panorama, select Cloud ServicesConfigurationNGFW Connector and select the settings icon.
   2. Add Prisma Browser Connector TSG ID.
   3. Create a Service Account in Strata Cloud Manager under Identity & Access Management.
   4. Get the Client Secret for this Service Account.
   5. On Panorama, add this Client Secret.
   6. On Strata Cloud Manager, select ConfigurationZTNA ConnectorOverviewOverview. Under NGFW Connector, copy the secret Key.
   7. Commit and Push to initiate the connection to Prisma Access.
   8. Verify the connection status on Panorama.
4. Onboard the NGFW as an unclaimed connector.

   1. In Panorama, select Cloud ServicesConfigurationNGFW Connector and select Add.
   2. Enter a descriptive Name for the NGFW Connector.
   3. Choose the Template Stack and Template that manages this NGFW.
   4. Select the specific NGFW Device (identified by its serial number) from the dropdown list.
   5. Add a routable Loopback IP address for the NGFW.
   6. Select the WAN interface configured earlier in the prerequisites.
   7. Commit the changes from Panorama to NGFW and verify the NGFW Connector registration. You can see the NGFW's public IP address.
5. |(Optional) Configure DNS Proxy for private application name resolution.

   Use this procedure only if you don't have a private DNS server capable of resolving your internal applications and choose to use Panorama's DNS Proxy for static entries or wildcard resolution.

   1. In Panorama, select DeviceSetupServices and select the proxy object (for example,ztna_ngfw_proxy).
   2. Under DNS Settings, select the DNS Proxy Object, and then select ztna_ngfw_proxy.
   3. Select NetworkDNS Proxy and add DNS Static Entries for your private applications. Map application FQDNs to their corresponding IP addresses and select OK.
   4. Commit to save the DNS Proxy configuration and changes to Panorama.
      When an NGFW Connector is onboarded, Prisma Access service configuresztna_ngfw_proxy in NetworkDNS Proxy . If a DNS server is configured,ztna_ngfw_proxy uses the same DNS IP addresses.
6. (Optional) Configure a DNS server for private application name resolution.

   1. In Panorama, select TemplatesDeviceSetupServices and select the settings icon.
   2. Under DNS Settings, select Servers, add a Primary DNS Server, and a Secondary DNS Server.