Strata Cloud Manager
Onboard NGFWs using Zero Touch Provisioning (ZTP)
Table of Contents
Onboard NGFWs using Zero Touch Provisioning (ZTP)
Workflow for onboarding NGFWs to Strata Cloud Manager using Zero Touch Provisioning
(ZTP).
| Where Can I Use This? | What Do I Need? |
|---|---|
| One of these: |
Learn about onboarding NGFWs using Zero Touch Provisioning (ZTP).
Onboard a ZTP NGFW
ZTP is designed to simplify and automate the onboarding of new
firewalls to Strata Cloud Manager. ZTP streamlines the initial firewall
deployment process by allowing network administrators to ship managed firewalls
directly to their branches and automatically add the firewall to their tenant
after the ZTP firewall successfully connects to the Palo Alto Networks ZTP
service. This allows businesses to save on time and resources when deploying new
firewalls at branch locations by removing the need for IT administrators to
manually provision the new managed firewall. After successful onboarding, Strata Cloud Manager provides the means to configure and manage your
firewalls.
The ZTP cloud service supports a direct internet connection to
successfully onboard a ZTP firewall to Strata Cloud Manager. The ZTP cloud
service does not support an explicit web proxy and is unable to onboard a ZTP
firewall to Strata Cloud Manager if an explicit web proxy is configured as a
gateway to the internet for your ZTP firewalls and Strata Cloud Manager.
Review and subscribe to ZTP Service Status events to be notified about
scheduled maintenance windows, outages, and workarounds.
Before you begin setting up ZTP on Strata Cloud Manager, review the
Firewall Hardware Quick Start and Reference Guides
to understand how to correctly install your firewall to successfully leverage
ZTP.
ZTP Configuration Elements
The following elements work together to allow you to quickly onboard newly
deployed ZTP firewalls by automatically adding them to Strata Cloud Manager
using the ZTP service.
- Customer Support Portal (CSP) Account—The ZTP service uses the Palo Alto Networks Customer Support Portal to register the firewall with your account and identify the tenants that you can associate with your ZTP firewall.
- Tenant—The Strata Cloud Manager tenant the ZTP firewall will be associated with. This is a logical container for your apps and devices.
- Business Administrator or Superuser Role—The enterprise roles that can onboard a ZTP firewall. These roles are assigned through Common Services.
- Claim Key—Eight-digit numeric key physically attached to the ZTP firewall used to register the ZTP firewall with the CSP.
- Serial Number—A 10-32 character alphanumeric identifier attached to the ZTP firewall. You can find this on a sticker on the back of the firewall.
- Activation URL—URL used to onboard your ZTP firewall to cloud management.
- Business Administrator or higher role activates a ZTP firewall by visiting the ZTP activation URL and the firewall serial number and claim key. If you have more than one tenant or CSP account, you can select which one you want to associate with the firewall.
- The ZTP firewall registers with the CSP and with the Strata Cloud Manager tenant specified during activation.
- A ZTP firewall successfully registered with the ZTP service automatically appears in Strata Cloud Manager (Settings > Firewall Setup > Device Management).
- When the firewall connects to the internet, the ZTP firewall requests a device certificate from the CSP in order to connect to the ZTP service.
- The ZTP service pushes the Strata Cloud Manager FQDN and the ZTP configuration to the firewall.
- The ZTP firewall connects to Strata Cloud Manager.
Onboard a ZTP NGFW to Strata Cloud Manager
With a Business Administrator or greater role, access ZTP device activation to add a ZTP
firewall to Strata Cloud Manager. To add the ZTP firewall, you must enter
the firewall serial number and claim key provided by Palo Alto Networks and
then register the firewall with the ZTP service. Registering the firewall
claims the firewall as an asset in your account in the Customer Support
Portal and allows the ZTP service to associate the firewall with Strata Cloud Manager.
Before you can successfully add a ZTP firewall to Strata Cloud Manager, you must ensure that you have deployed a Dynamic Host
Configuration Protocol (DHCP) server on the network. You must have a DHCP
server configured to successfully onboard a ZTP firewall to Strata Cloud Manager. The ZTP firewall is unable to connect to the Palo
Alto Networks ZTP service to facilitate onboarding without a DHCP
server.
You can't migrate a firewall added to Strata Cloud Manager using ZTP from one tenant to another.
While adding a ZTP firewall to Strata Cloud Manager, don't perform
any commits on the ZTP firewall before you verify that the firewall appears
in Strata Cloud Manager according to the steps below. Performing a local
commit on the ZTP firewall disables ZTP functionality and results in the
failure to successfully add the firewall to Strata Cloud Manager.
Only the following NGFW models are supported for ZTP:
- PA-400 Series
- PA-400R Series
- PA-1400 Series
- PA-3400 Series
- PA-5400 Series
- PA-5450 and PA-7500
- Activate the licenses required for Strata Cloud Manager.
- Activate Strata Logging Service.Activate AIOps for NGFW.(Optional) Create a device onboarding rule to associate the firewall with a folder and push a configuration when the firewall first connects to Strata Cloud Manager.Onboard the ZTP firewall to Strata Cloud Manager.
- With the role of Business Administrator or higher, access ZTP device activation.Select the tenant (if you have more than one in your CSP account).Enter the Serial Number of the ZTP firewall.Enter the Claim Key for the ZTP firewall.Activate the firewall.Connect the ethernet cable to Eth1/1 on the ZTP firewall and power on.Ensure that you have correctly cabled the firewall before powering it on. ZTP connection is a one-time event, and if it fails, you will need to take corrective action.Only Ethernet 1/1 is supported to successfully onboard a ZTP firewall to Strata Cloud Manager. You must keep Ethernet 1/1 connected after onboarding to continue managing on Strata Cloud Manager.Verify the firewall successfully onboarded to Strata Cloud Manager.
- Log in to Strata Cloud Manager.Select and verify the ZTP firewall appears.Move the firewall to a folder of your choice.Folders are used to logically group your firewalls for simplified configuration management. Skip this step if you created a device onboarding rule to automatically move the firewall to a target folder.(HA only) Both firewalls must be in the same folder to configure HA. If you need to configure your firewalls in a high availability (HA) configuration, be sure to plan your folder structure accordingly and move both firewalls to the same folder before you configure HA.Additionally, firewalls in an HA configuration cannot be moved to a new folder. To move them, you must first break the HA configuration, move both firewalls to the new folder, and then reconfigure HA.
- Select and expand the All Firewalls folder.Expand the Actions menu and Move.Select the folder Destination and Move.Push Config to push your configuration changes.Finally, check the Strata Cloud Manager Command Center and confirm that your firewall appears in the Summary view.
