Panorama Virtual Appliance and Virtual Dedicated Log Collector on Google Cloud Platform

Download the Panorama virtual appliance image.
Log in to the Palo Alto Networks Support Portal.
Select
Updates
Software Updates
and filter by
Panorama Base Images
.
Download the latest version of the Panorama on GCP
tar.gz
image.
Upload the Panorama virtual appliance image to the Google Cloud Platform.
Log in to the Google Cloud Console.
From the
Products and Services
menu, select
Storage
.
Click
Create Bucket
, configure the new storage bucket and click
Create.
Select the storage bucket you created in the previous step, click
Upload files
, and select the Panorama virtual appliance image you downloaded.
From the
Products and Services
menu, select
Compute Engine
Images
.
Click
Create Image
and create the Panorama virtual appliance image:
Name
the Panorama virtual appliance image.
In the
Source
field, select
Cloud Storage file
from the drop-down menu.
Click
Browse
and navigate to the storage bucket where you uploaded the Panorama virtual appliance image, and
Select
the uploaded image.
Create
the Panorama virtual appliance image.
Configure the Panorama virtual appliance.
From the
Products and Services
menu and select the
Compute Engine
.
Click
Create Instance
to begin deploying the Panorama virtual appliance.
Add a descriptive
Name
to easily identify the Panorama virtual appliance.
Select the
Zone
where you want to deploy the Panorama virtual appliance.
Allocate the
Machine Type
CPU cores and memory. Refer to the Setup Prerequisites for the Panorama Virtual Appliance for minimum resource requirements.
For the
Boot Disk
, click
Change
Custom image
, select the Panorama image file you uploaded in Step 2, and click
Select
.
Under
Identity and API access
,
Allow full access to all Cloud APIs
.
Under
Firewall
,
Allow HTTPS traffic
.
Enable management access to the Panorama virtual appliance.
Expand
Management, disks, networking SSH keys
.
Enable access to the serial port so you can manage the Panorama virtual appliance.
Configure the management interface on the Panorama virtual appliance.
To learn more about how to reserve IP addresses, refer to the information about how to Reserve a Static Internal IP Address and how to Reserve a Static External IP Address.
The Panorama virtual appliance on GCP supports a single management interface; ou must use this interface for log collection and device management.
Configure the SSH key. You need an SSH key to access the Panorama virtual appliance CLI to configure the administrative user password after initial deployment.
(
Panorama and Log Collector mode
) Add additional storage for log collection. Repeat this step as needed to add additional virtual logging disks.
If you intend to use the Panorama virtual appliance in Panorama mode or as a Dedicated Log Collector, add the virtual logging disks during the initial deployment. By default, the Panorama virtual appliance is in Panorama mode for the initial deployment when you meet the Panorama mode resource requirements and you have added at least one virtual logging disk. Otherwise, the Panorama virtual appliance defaults to Management Only mode. Change the Panorama virtual appliance to Management Only mode if you need to only manage devices and Dedicated Log Collectors and you don’t need to collect logs locally.
The Panorama virtual appliance on GCP supports only 2TB logging disks and, in total, supports up to 24TB of log storage. You cannot add a logging disk smaller than 2TB or a logging disk with a size that is not evenly divisible by the 2TB logging disk requirement because the Panorama virtual appliance partitions logging disks larger than 2TB into 2TB partitions.
Create
(deploy) the Panorama virtual appliance. The Panorama virtual appliances takes approximately 10 minutes to boot up after initial deployment.
Configure a new administrative password for the Panorama virtual appliance.
Use a private key to access the CLI and configure a unique administrative password so that you can access the web interface of the Panorama virtual appliance.
Activate the licenses on the Panorama virtual appliance.
Finish configuring the Panorama virtual appliance for your deployment needs.
(
Management Only mode
) Set Up a Panorama Virtual Appliance in Management Only Mode.
(
Log Collector mode
) Skip to Step 6 to set up the Panorama virtual appliance as a Log Collector.
When configuring the Management interface in Step 9, enter the
Public IP Address
of the Dedicated Log Collector. You cannot specify
IP Address
,
Netmask
, or
Gateway
.
(
Panorama and Management Only mode
) Configure a Managed Collector. Manage a Dedicated Log Collector from the Panorama virtual appliance for log collection of managed firewalls.