Install Panorama on Hyper-V
Table of Contents
Expand all | Collapse all
-
- Determine Panorama Log Storage Requirements
-
- Setup Prerequisites for the Panorama Virtual Appliance
- Perform Initial Configuration of the Panorama Virtual Appliance
- Set Up The Panorama Virtual Appliance as a Log Collector
- Set Up the Panorama Virtual Appliance with Local Log Collector
- Set up a Panorama Virtual Appliance in Panorama Mode
- Set up a Panorama Virtual Appliance in Management Only Mode
-
- Preserve Existing Logs When Adding Storage on Panorama Virtual Appliance in Legacy Mode
- Add a Virtual Disk to Panorama on an ESXi Server
- Add a Virtual Disk to Panorama on vCloud Air
- Add a Virtual Disk to Panorama on Alibaba Cloud
- Add a Virtual Disk to Panorama on AWS
- Add a Virtual Disk to Panorama on Azure
- Add a Virtual Disk to Panorama on Google Cloud Platform
- Add a Virtual Disk to Panorama on KVM
- Add a Virtual Disk to Panorama on Hyper-V
- Add a Virtual Disk to Panorama on Oracle Cloud Infrastructure (OCI)
- Mount the Panorama ESXi Server to an NFS Datastore
-
- Increase CPUs and Memory for Panorama on an ESXi Server
- Increase CPUs and Memory for Panorama on vCloud Air
- Increase CPUs and Memory for Panorama on Alibaba Cloud
- Increase CPUs and Memory for Panorama on AWS
- Increase CPUs and Memory for Panorama on Azure
- Increase CPUs and Memory for Panorama on Google Cloud Platform
- Increase CPUs and Memory for Panorama on KVM
- Increase CPUs and Memory for Panorama on Hyper-V
- Increase the CPUs and Memory for Panorama on Oracle Cloud Infrastructure (OCI)
- Complete the Panorama Virtual Appliance Setup
-
- Convert Your Evaluation Panorama to a Production Panorama with Local Log Collector
- Convert Your Evaluation Panorama to a Production Panorama without Local Log Collector
- Convert Your Evaluation Panorama to VM-Flex Licensing with Local Log Collector
- Convert Your Evaluation Panorama to VM-Flex Licensing without Local Log Collector
- Convert Your Production Panorama to an ELA Panorama
-
- Register Panorama
- Activate a Panorama Support License
- Activate/Retrieve a Firewall Management License when the Panorama Virtual Appliance is Internet-connected
- Activate/Retrieve a Firewall Management License when the Panorama Virtual Appliance is not Internet-connected
- Activate/Retrieve a Firewall Management License on the M-Series Appliance
- Install the Panorama Device Certificate
- Install the Device Certificate for a Dedicated Log Collector
-
- Migrate from a Panorama Virtual Appliance to an M-Series Appliance
- Migrate a Panorama Virtual Appliance to a Different Hypervisor
- Migrate from an M-Series Appliance to a Panorama Virtual Appliance
- Migrate from an M-100 Appliance to an M-500 Appliance
- Migrate from an M-100 or M-500 Appliance to an M-200 or M-600 Appliance
-
- Configure an Admin Role Profile
- Configure an Access Domain
-
- Configure a Panorama Administrator Account
- Configure Local or External Authentication for Panorama Administrators
- Configure a Panorama Administrator with Certificate-Based Authentication for the Web Interface
- Configure an Administrator with SSH Key-Based Authentication for the CLI
- Configure RADIUS Authentication for Panorama Administrators
- Configure TACACS+ Authentication for Panorama Administrators
- Configure SAML Authentication for Panorama Administrators
- Configure Tracking of Administrator Activity
-
- Add a Firewall as a Managed Device
-
- Add a Device Group
- Create a Device Group Hierarchy
- Create Objects for Use in Shared or Device Group Policy
- Revert to Inherited Object Values
- Manage Unused Shared Objects
- Manage Precedence of Inherited Objects
- Move or Clone a Policy Rule or Object to a Different Device Group
- Push a Policy Rule to a Subset of Firewalls
- Device Group Push to a Multi-VSYS Firewall
- Manage the Rule Hierarchy
- Manage the Master Key from Panorama
- Schedule a Configuration Push to Managed Firewalls
- Redistribute Data to Managed Firewalls
-
- Plan the Transition to Panorama Management
- Migrate a Firewall to Panorama Management and Reuse Existing Configuration
- Migrate a Firewall to Panorama Management and Push a New Configuration
- Migrate a Firewall HA Pair to Panorama Management and Reuse Existing Configuration
- Migrate a Firewall HA Pair to Panorama Management and Push a New Configuration
- Load a Partial Firewall Configuration into Panorama
- Localize a Panorama Pushed Configuration on a Managed Firewall
-
- Configure a Managed Collector
- Configure Log Forwarding to Panorama
- Configure Syslog Forwarding to External Destinations
- Forward Logs to Strata Logging Service
- Verify Log Forwarding to Panorama
- Modify Log Forwarding and Buffering Defaults
- Configure Log Forwarding from Panorama to External Destinations
-
- Add Standalone WildFire Appliances to Manage with Panorama
- Remove a WildFire Appliance from Panorama Management
-
-
- Configure a Cluster and Add Nodes on Panorama
- Configure General Cluster Settings on Panorama
- Remove a Cluster from Panorama Management
- Configure Appliance-to-Appliance Encryption Using Predefined Certificates Centrally on Panorama
- Configure Appliance-to-Appliance Encryption Using Custom Certificates Centrally on Panorama
- View WildFire Cluster Status Using Panorama
-
-
- Preview, Validate, or Commit Configuration Changes
- Enable Automated Commit Recovery
- Compare Changes in Panorama Configurations
- Manage Locks for Restricting Configuration Changes
- Add Custom Logos to Panorama
- Use the Panorama Task Manager
- Reboot or Shut Down Panorama
- Configure Panorama Password Profiles and Complexity
-
-
- Verify Panorama Port Usage
- Resolve Zero Log Storage for a Collector Group
- Replace a Failed Disk on an M-Series Appliance
- Replace the Virtual Disk on an ESXi Server
- Replace the Virtual Disk on vCloud Air
- Migrate Logs to a New M-Series Appliance in Log Collector Mode
- Migrate Logs to a New M-Series Appliance in Panorama Mode
- Migrate Logs to a New M-Series Appliance Model in Panorama Mode in High Availability
- Migrate Logs to the Same M-Series Appliance Model in Panorama Mode in High Availability
- Migrate Log Collectors after Failure/RMA of Non-HA Panorama
- Regenerate Metadata for M-Series Appliance RAID Pairs
- View Log Query Jobs
- Troubleshoot Registration or Serial Number Errors
- Troubleshoot Reporting Errors
- Troubleshoot Device Management License Errors
- Troubleshoot Automatically Reverted Firewall Configurations
- View Task Success or Failure Status
- Generate a Stats Dump File for a Managed Firewall
- Recover Managed Device Connectivity to Panorama
- Restore an Expired Device Certificate
Install Panorama on Hyper-V
How to deploy a Panorama™ virtual appliance and a virtual
Dedicated Log Collector on Hyper-V.
You can now deploy Panorama™ and a Dedicated
Log Collector on Hyper-V. Panorama deployed on Hyper-V is Bring
Your Own License (BYOL), supports all deployment modes (Panorama,
Log Collector, and Management Only), and shares the same processes
and functionality as the M-Series hardware appliances. For more information
on Panorama modes, see Panorama
Models. Panorama virtual appliance and virtual Dedicated
Log Collector on Hyper-V is available only on PAN-OS 8.1.3 and later
releases.
- Download the Panorama 10.1 base image VHDX file.
- Log in to the Palo Alto Networks Support Portal.
- Selectand filter byUpdatesSoftware UpdatesPanorama Base Imagesto download the VHDX file (Panorama-HPV-10.1.0.vhdx).
- Set up any vSwitch(es) that you will need. For more information, review the Virtual Switch Types for more information.
- From Hyper-V Manager, select the host and selectto open the Virtual Switch Manager window.ActionVirtual Switch Manager
- UnderCreate virtual switch, select the type of vSwitch to create and clickCreate Virtual Switch.
- Install the Panorama virtual appliance.
- On the Hyper-V Manager, select the host and selectConfigure the following settings in the New Virtual Machine Wizard:ActionNewVirtual Machine.
- Choose aNameandLocationfor the Panorama virtual appliance. The Panorama virtual appliance stores the VHDX file at the specified location.
- ChooseGeneration 1. This is the default option and the only version supported.
- ForStartup Memory, assign the memory based on the intended system mode. See the Setup Prerequisites for the Panorama Virtual Appliance for the memory requirements for each mode.Do not enable dynamic memory; the Panorama virtual appliance requires static memory allocation.
- ConfigureNetworking. Select an external vSwitch to connect the management interface on the firewall.
- To connect theVirtual Hard Disk, selectUse an existing virtual hard diskand browse to the VHDX file you downloaded earlier.
- Review the summary and clickFinish.
- Allocate the Panorama virtual appliance CPU cores.Review the Setup Prerequisites for the Panorama Virtual Appliance for minimum resource requirements.If you plan to use the Panorama virtual appliance as a Dedicated Log Collector, ensure that you configure the appliance with the required resources during initial deployment. The Panorama virtual appliance does not remain in Log Collector mode if you resize the virtual machine after you deploy it, and this results in a loss of log data.
- In theHardwarelist, selectProcessor.
- Edit the currently allocatedNumber of virtual processors.
- Connect at least one network adapter for the dataplane interface on the firewall. Repeat this to create additional network interfaces on the Panorama virtual appliance.
- Selectand select theSettingsHardwareAdd HardwareHardware typefor your network adapter.Legacy Network Adapter and SR-IOV are not supported. If selected, the VM-Series firewall will boot into maintenance mode.
- ClickOK.
- (Optional) Add additional storage for log collection. Repeat this step as needed to add additional virtual logging disks. If you want to deploy the Panorama virtual appliance in Management Only mode, continue to Step 6.If you intend to use the Panorama virtual appliance in Panorama mode or as a Dedicated Log Collector, add the virtual logging disks during the initial deployment. By default, the Panorama virtual appliance is in Panorama mode for the initial deployment when you meet the Panorama mode resource requirements and have added at least one virtual logging disk. Otherwise, the Panorama virtual appliance defaults to Management Only mode. Change the Panorama virtual appliance to Management Only mode if you just want to manage devices and Dedicated Log Collectors, and to not collect logs locally.The Panorama virtual appliance on Hyper-V only supports 2TB logging disks, and in total supports up to 24TB of log storage. You are unable to add a logging disk smaller than 2TB, or a logging disk with a size not divisible by the 2TB logging disk requirement. The Panorama virtual appliance partitions logging disks larger than 2TB into 2TB partitions.
- On the Hyper-V Manager, select the host and selectActionNewHard Disk.
- If you see the Before You Begin prompt, clickNextto begin adding the virtual logging disk.
- For the Disk Format, selectVHDX. ClickNext. to continue
- For the Disk Type, selectFixed SizeorDynamically Expandingbased on your needs. ClickNextto continue.
- Specify theNameandLocationfor the virtual logging disk file. ClickNextto continue.
- To configure the disk, selectCreate a new virtual hard diskand enter the disk size. ClickNextto continue.
- Review the Summary andFinishadding the virtual hard logging disk.
- Power on the Panorama virtual appliance.
- Select the Panorama virtual appliance instance from the list ofVirtual Machines.
- Selectto power on the Panorama virtual appliance.ActionStart
- Connect to the Panorama virtual appliance console from the Hyper-V Manager.
- In theVirtual Machineslist, select the Panorama virtual appliance.
- Selectand enter the username and password to log in (default is admin for both).ActionsConnect
- Configure a new administrative password for the Panorama virtual appliance.You must configure a unique administrative password before you can access the web interface or CLI of the Panorama virtual appliance. The new password must be a minimum of eight characters and include a minimum of one lowercase character, one uppercase character, and one number or special character.When you first log in to the Panorama CLI, you are prompted to enter theOld Passwordand theNew Passwordfor theadminuser before you can continue.
- Configure the IP address of the management interface.
- Enter the following commands, where<Panorama-IP>is the IP address you want to assign to the Panorama management interface,<netmask>is the subnet mask,<gateway-IP>is the IP address of the network gateway, and<DNS-IP>is the IP address of the DNS server:admin>configureadmin#set deviceconfig system ip-addressadmin#<Panorama-IP>netmask<netmask>default-gateway<gateway-IP>dns-setting servers primary<DNS-IP>commitadmin#exit
- Troubleshoot Connectivity to Network Resources to verify network access to external services required for firewall management, such as the default gateway, DNS server, and the Palo Alto Networks Update Server, as shown in the following example:
- Register the Panorama virtual appliance and activate the device management license and support licenses.
- (VM Flex Licensing Only) Provisioning the Panorama Virtual Appliance Serial Number.When leveraging VM Flex licensing, this step is required to generate the Panorama virtual appliance serial number needed to register the Panorama virtual appliance with the Palo Alto Networks Customer Support Portal (CSP).
- You must register the Panorama virtual appliance using the serial number provided by Palo Alto Networks in the order fulfillment email.This step is not required when leveraging VM Flex licensing as the serial number is automatically registered with the CSP when generated.
- Complete configuring the Panorama virtual appliance for your deployment needs.
- For Panorama in Log Collector Mode.
- Add a Virtual Disk to Panorama on Hyper-V as needed.Adding at least one virtual logging disk is required before you can change the Panorama virtual appliance to Log Collector mode.
- Begin at Step 6 to switch to Log Collector mode.Enter the Public IP address of the Dedicated Log Collector when you add the Log Collector as a managed collector to the Panorama management server. You cannot specify theIP Address,Netmask, orGateway.
- For Panorama in Panorama mode.
- Adding at least one virtual logging disk is required before you can change the Panorama virtual appliance to Panorama mode.
- For Panorama in Management Only mode.
- Configure a Managed Collector to add a Dedicated Log Collector to the Panorama virtual appliance.Management Only mode does not support local log collection, and requires a Dedicated Log Collector to store managed device logs.