Add a Firewall as a Managed Device

Configure the firewall to communicate with Panorama.

Repeat this step for each firewall Panorama will manage.

Perform initial configuration on the firewall so that it is accessible and can communicate with Panorama over the network.
Configure each data interface you plan to use on the firewall and attach it to a security zone so that you can push configuration and policy from Panorama.
Add the Panorama IP address to the firewall.
Select
Device
Setup
Management
and edit the Panorama Settings.
Enter the Panorama IP address in the first field.
Panorama issues a single IP address for device management, log collection, reporting, and dynamic updates. Enter the external, Internet-bound IP address to ensure Panorama can successfully access existing and new managed devices and Log Collectors. If an internal Panorama IP address is configured, you may be unable to manage some devices. For example, if you Install Panorama on AWS and enter the internal IP address, Panorama is unable to manage devices or Log Collectors outside of the AWS security group.
(
Optional
) If you have set up a high availability (HA) pair in Panorama, enter the IP address of the secondary Panorama in the second field.
Click
OK
.
Select
Commit
and
Commit
your changes.

Add one or more firewalls to Panorama.

Add one or more firewalls.
Add a new managed device (

Panorama

Managed Devices

Summary

).

Enter the firewall

Serial

number. If you are adding multiple firewalls, enter each serial number on a separate line. If you want to associate the new firewalls with a device group, template stack, collector group, or Log Collector for the initial deployment, continue to the next step. To manually assign each firewall, click

OK

and continue to Step 3.

Select the

Associate Devices

check box and click

OK

.



Assign the

Device Group

,

Template Stack

,

Collector Group

, and

Log Collector

as needed from the drop-down for each column.

Enable

Auto Push on 1st connect

check box to automatically push the device group and template stack configuration to the new devices when they successfully connect to Panorama.

The

Auto Push on 1st Connect

option is supported only on firewalls running PAN-OS 8.1 or later releases. The

commit all

job executes from Panorama to managed devices running PAN-OS 8.1 and later releases.

(

Optional

) Select a PAN-OS release version in the

To SW Version

column to begin automatically upgrading the managed firewall to the specified PAN-OS release version upon successful connection to Panorama.

To upgrade a managed firewall to a target PAN-OS release on first connection, you must install the minimum content release version required for that PAN-OS release before adding the firewall as a managed device. To do this, you must register the firewall, activate the support license, and install the content update before adding the firewall to Panorama management.

Leave this column empty if you do not want to automatically upgrade the managed firewall.

Click

OK

to add the devices.


Bulk import multiple firewalls using a comma-separated values (CSV) file.
Add a new managed device (
Panorama
Managed Devices
Summary
).
Click
Import
.

Download Sample CSV
and edit the downloaded CSV file with the firewalls you are adding. You can choose to assign the firewalls to a device group, template stack, Collector Group, and Log Collector from the CSV or enter only the firewall serial numbers and assign them from the web interface. Save the CSV after you finish editing it.
Browse
and select the CSV file you edited in the previous step.
If not already assigned in the CSV, assign the firewalls a
Device Group
,
Template Stack
,
Collector Group
, and
Log Collector
as needed from the drop-down for each column.
If not already enabled in the CSV, enable
Auto Push on 1st connect
check box to automatically push the device group and template stack configuration to the new devices when they successfully connect to Panorama.
(
Optional
) Select a PAN-OS release version in the
To SW Version
column to begin automatically upgrading the managed firewall to the specified PAN-OS release version upon successful connection to Panorama.
Leave this column empty if you do not want to automatically upgrade the managed firewall.
Click
OK
to add the devices.



(

Optional

) Add a

Tag

. Tags make it easier for you to find a firewall from a large list; they help you to dynamically filter and refine the list of firewalls in your display. For example, if you add a tag called branch office, you can filter for all branch office firewalls across your network.

Select each firewall and click
Tag
.
Click
Add
, enter a string of up to 31 characters (no empty spaces), and click
OK
.

If your deployment is using custom certificates for authentication between Panorama and managed devices, deploy the custom client device certificate. For more information, see Set Up Authentication Using Custom Certificates and Add New Client Devices.

Select

Commit

Commit to Panorama

and

Commit

your changes.

Verify that the firewall is connected to Panorama.

Click

Panorama

Managed Devices

Summary

.

Verify that the

Device State

for the new device shows as

Connected

.