Automatic Content Push for VM-Series and CN-Series Firewalls

Automatically push dynamic content updates to VM-Series and CN-Series firewalls on first connection to the Panorama™ management server.
PAN-OS 10.2 introduces the ability to automatically push the latest Antivirus and Applications and Threats content updates on first connection when onboarding a new VM-Series and CN-Series firewall to the Panorama™ management server. When leveraging auto-scale, enabling this setting allows you to maintain existing images for VM-Series and CN-Series firewalls leveraging dynamic content in their configurations, such as in policies and App-ID. This helps eliminate the operational overhead required to update VM-Series and CN-Series firewall images when new dynamic content update versions are introduced.
Panorama attempts to push the installed dynamic content updates on the first connection only and does not attempt any subsequent pushes if the initial push fails for any reason.
For example, you add a VM-Series firewall to Panorama management and enable
Auto Push on 1st Connect
to automatically push the device group and template stack configuration to the VM-Series firewall on first connection. However, the template stack contains an invalid configuration and the push to the VM-Series firewall fails. In this scenario, the automatic content push to the VM-Series firewall also fails because the configuration push and dynamic content version push are included in the same push operation to the VM-Series firewall.
VM-Series firewalls deployed on NSX and hardware firewalls are not supported.
  1. This is required to automatically push the Antivirus and Applications and Threats content updates. Panorama only the Antivirus and Applications and Threats versions it has installed to VM-Series and CN-Series firewalls.
  2. Configure Panorama to automatically push the latest dynamic content updates to VM-Series and CN-Series firewalls on first connection.
    This step assumes you have already configured a template stack for your VM-Series and CN-Series firewall configuration.
    1. Select
      Panorama
      Templates
      and click the template stack that contains the VM-Series and CN-Series firewall configuration.
    2. Check (enable)
      Automatically push content when software device registers to Panorama
      .
    3. Click
      OK
      .
  3. Commit
    and
    Commit to Panorama
    .
  4. When adding the VM-Series or CN-Series firewall to Panorama management, be sure to
    Associate Devices
    and assign the firewalls to the Template Stack where you enabled Panorama to automatically push the dynamic content updates installed on Panorama to the firewalls on first connection.
    Panorama does not push the installed dynamic content updates if the VM-Series or CN-Series firewall is not assigned to a Template Stack prior to first connection.
  5. Verify the dynamic content version installed on the firewall.
    1. Select
      Panorama
      Managed Devices
      Summary
      and locate the managed firewalls you added.
    2. Verify the Device State is
      Connected
      .
    3. Verify the Antivirus and Apps and Threat versions match the versions installed on Panorama.

Recommended For You