Add a Firewall as a Managed Device
To use Panorama for managing your firewalls,
you need to enable a connection between the firewall and Panorama.
A successful connection requires that you enter the Panorama IP
address on each firewall that Panorama will manage and to also enter
the serial number of each firewall on Panorama. When you add a firewall
as a managed device, you can associate the new firewall with a device
group, template stack, collector group, and Log Collector during
the initial deployment. Additionally, you have the option to automatically
push the configuration to your newly added firewall when the firewall
first connects to Panorama, which ensures that firewalls are immediately
configured and ready to secure your network.
You can
only bulk import single vsys firewalls to be managed by Panorama.
The
firewall uses the Panorama management server IP address to set up
an SSL connection to register with Panorama. Panorama and the firewall
authenticate each other using 2,048-bit certificates and AES-256
encrypted SSL connections for configuration management and log collection.
Prepare Panorama and each firewall as follows:
- Configure the firewall to communicate with Panorama.Repeat this step for each firewall Panorama will manage.
- Perform initial configuration on the firewall so that it is accessible and can communicate with Panorama over the network.
- Configure each data interface you plan to use on the firewall and attach it to a security zone so that you can push configuration and policy from Panorama.
- Add the Panorama IP address to the firewall.
- Selectand edit the Panorama Settings.DeviceSetupManagement
- Enter the Panorama IP address in the first field.Panorama issues a single IP address for device management, log collection, reporting, and dynamic updates. Enter the external, Internet-bound IP address to ensure Panorama can successfully access existing and new managed devices and Log Collectors. If an internal Panorama IP address is configured, you may be unable to manage some devices. For example, if you Install Panorama on AWS and enter the internal IP address, Panorama is unable to manage devices or Log Collectors outside of the AWS security group.
- (Optional) If you have set up a high availability (HA) pair in Panorama, enter the IP address of the secondary Panorama in the second field.
- ClickOK.
- SelectCommitandCommityour changes.
- Add one or more firewalls to Panorama.
- Add one or more firewalls.
- Add a new managed device ().PanoramaManaged DevicesSummary
- Enter the firewallSerialnumber. If you are adding multiple firewalls, enter each serial number on a separate line. If you want to associate the new firewalls with a device group, template stack, collector group, or Log Collector for the initial deployment, continue to the next step. To manually assign each firewall, clickOKand continue to Step 3.
- Select theAssociate Devicescheck box and clickOK.
- Assign theDevice Group,Template Stack,Collector Group, andLog Collectoras needed from the drop-down for each column.
- EnableAuto Push on 1st connectcheck box to automatically push the device group and template stack configuration to the new devices when they successfully connect to Panorama.TheAuto Push on 1st Connectoption is supported only on firewalls running PAN-OS 8.1 or later releases. Thecommit alljob executes from Panorama to managed devices running PAN-OS 8.1 and later releases.
- (Optional) Select a PAN-OS release version in theTo SW Versioncolumn to begin automatically upgrading the managed firewall to the specified PAN-OS release version upon successful connection to Panorama.To upgrade a managed firewall to a target PAN-OS release on first connection, you must install the minimum content release version required for that PAN-OS release before adding the firewall as a managed device. To do this, you must register the firewall, activate the support license, and install the content update before adding the firewall to Panorama management.Leave this column empty if you do not want to automatically upgrade the managed firewall.
- ClickOKto add the devices.
- Bulk import multiple firewalls using a comma-separated values (CSV) file.
- Add a new managed device ().PanoramaManaged DevicesSummary
- ClickImport.
- Download Sample CSVand edit the downloaded CSV file with the firewalls you are adding. You can choose to assign the firewalls to a device group, template stack, Collector Group, and Log Collector from the CSV or enter only the firewall serial numbers and assign them from the web interface. Save the CSV after you finish editing it.
- Browseand select the CSV file you edited in the previous step.
- If not already assigned in the CSV, assign the firewalls aDevice Group,Template Stack,Collector Group, andLog Collectoras needed from the drop-down for each column.
- If not already enabled in the CSV, enableAuto Push on 1st connectcheck box to automatically push the device group and template stack configuration to the new devices when they successfully connect to Panorama.
- (Optional) Select a PAN-OS release version in theTo SW Versioncolumn to begin automatically upgrading the managed firewall to the specified PAN-OS release version upon successful connection to Panorama.Leave this column empty if you do not want to automatically upgrade the managed firewall.
- ClickOKto add the devices.
- (Optional) Add aTag. Tags make it easier for you to find a firewall from a large list; they help you to dynamically filter and refine the list of firewalls in your display. For example, if you add a tag called branch office, you can filter for all branch office firewalls across your network.
- Select each firewall and clickTag.
- ClickAdd, enter a string of up to 31 characters (no empty spaces), and clickOK.
- If your deployment is using custom certificates for authentication between Panorama and managed devices, deploy the custom client device certificate. For more information, see Set Up Authentication Using Custom Certificates and Add New Client Devices.
- SelectandCommitCommit to PanoramaCommityour changes.
- Verify that the firewall is connected to Panorama.
- Click.PanoramaManaged DevicesSummary
- Verify that theDevice Statefor the new device shows asConnected.
Recommended For You
Recommended Videos
Recommended videos not found.