Install Panorama on an ESXi Server

1. Download the Panorama 11.0 base image Open Virtual Appliance (OVA) file.

   1. Log in to the Palo Alto Networks Support Portal.
   2. Select UpdatesSoftware Updates and filter by Panorama Base Images to download the OVA file (Panorama-ESX-11.0.0.ova).
2. Install Panorama.

   1. Launch the VMware vSphere Client and connect to the VMware server.
   2. Select FileDeploy OVF Template.
   3. Browse to select the Panorama OVA file and click Next.
   4. Confirm that the product name and description match the downloaded version, and click Next.
   5. Enter a descriptive name for the Panorama virtual appliance, and click Next.
   6. Select a datastore location (system disk) on which to install the Panorama image. See the Setup Prerequisites for the Panorama Virtual Appliance for the supported system disk sizes. After selecting the datastore, click Next.

      The Panorama virtual appliance must be initially installed with the Default system disk size. Installing the Panorama virtual appliance with a system disk larger than the Default system disk size is not supported and may result in limited utilization. You have the option to increase the system disk size after initial installation
   7. Select Thick Provision Lazy Zeroed as the disk format, and click Next.
   8. Specify which networks in the inventory to use for the Panorama virtual appliance, and click Next.
   9. Confirm the selected options, click Finish to start the installation process, and click Close when it finishes. Do not power on the Panorama virtual appliance yet.
3. Configure resources on the Panorama virtual appliance.

   1. Right-click the Panorama virtual appliance and Edit Settings.
   2. In the Hardware settings, allocate the CPUs and memory as necessary.

      The virtual appliance boots up in Panorama mode if you allocate sufficient CPUs and Memory and add a virtual logging disk (later in this procedure). Otherwise, the appliance boots up in Management Only mode. For details on the modes, see Panorama Models.
   3. Set the SCSI Controller to LSI Logic Parallel.
   4. (Optional) Add a virtual logging disk.

      This step is required in the following scenarios:

      • In Panorama mode to store logs on a dedicated logging disk.
      • Manage your SD-WAN deployment in Management Only mode.

      1. Add a disk, select Hard Disk as the hardware type, and click Next.
      2. Create a new virtual disk and click Next.
      3. Set the Disk Size to exactly 2TB.
         In Panorama mode, you can later add additional logging disks (for a total of 12) with 2TB of storage each. Expanding the size of a logging disk that is already added to Panorama is not supported.
      4. Select your preferred Disk Provisioning disk format.
         Consider your business needs when selecting the disk provisioning format. For more information regarding the disk provisioning performance considerations, refer to the VMware Thick vs Thin Disks and All Flash Arrays document, or additional VMware documentation.
         When adding multiple logging disks, it is a best practice to select the same Disk Provisioning format for all disks to avoid any unexpected performance issues that may arise.
      5. Select Specify a datastore or datastore structure as the location, Browse to a datastore that has sufficient storage, click OK, and click Next.
      6. Select a SCSI Virtual Device Node (you can use the default selection) and click Next.
         Panorama will fail to boot if you select a format other than SCSI.
      7. Verify that the settings are correct and click Finish.
   5. Click OK to save your changes.
4. Power on the Panorama virtual appliance.

   1. In the vSphere Client, right-click the Panorama virtual appliance and select PowerPower On. Wait for Panorama to boot up before continuing.
   2. Log in to the Panorama virtual appliance CLI from the ESXi console:

      1. Right-click the Panorama virtual appliance and select Open Console.
      2. Enter your username and password to log in (default is admin for both).
5. Configure a new administrative password for the Panorama virtual appliance.

   You must configure a unique administrative password before you can access the web interface or CLI of the Panorama virtual appliance. The new password must be a minimum of eight characters and include a minimum of one lowercase character, one uppercase character, and one number or special character.

   When you first log in to the Panorama CLI, you are prompted to enter the Old Password and the New Password for the admin user before you can continue.
6. Verify the Panorama is running the correct system mode.

   admin> show system info

   In the output, the system-mode indicates either panorama or management-only mode.
7. Register the Panorama virtual appliance and activate the device management license and support licenses.

   1. (VM Flex Licensing Only) Provisioning the Panorama Virtual Appliance Serial Number.

      When leveraging VM Flex licensing, this step is required to generate the Panorama virtual appliance serial number needed to register the Panorama virtual appliance with the Palo Alto Networks Customer Support Portal (CSP).
   2. Register Panorama.

      You must register the Panorama virtual appliance using the serial number provided by Palo Alto Networks in the order fulfillment email.

      This step is not required when leveraging VM Flex licensing as the serial number is automatically registered with the CSP when generated.
   3. Activate the firewall management license.

      • Activate/Retrieve a Firewall Management License when the Panorama Virtual Appliance is Internet-connected.
      • Activate/Retrieve a Firewall Management License when the Panorama Virtual Appliance is not Internet-connected.
   4. Activate a Panorama Support License.
8. Increase the System Disk for Panorama on an ESXi Server if you intend to use the Panorama virtual appliance for the following:

   • Manage your SD-WAN deployment in Panorama mode.
   • Requires additional storage space for dynamic updates when managing large-scale firewall deployments.
9. Complete configuring the Panorama virtual appliance for your deployment needs.

   • For Panorama in Log Collector Mode.
     1. Add a Virtual Disk to Panorama on an ESXi Server as needed.
        Adding at least one virtual logging disk is required before you can change the Panorama virtual appliance to Log Collector mode.
     2. Begin at Step 6 to switch to Log Collector mode.
        Enter the Public IP address of the Dedicated Log Collector when you add the Log Collector as a managed collector to the Panorama management server. You cannot specify the IP Address, Netmask, or Gateway.
   • For Panorama in Panorama mode.
     1. Add a Virtual Disk to Panorama on an ESXi Server.
        Adding at least one virtual logging disk is required before you can change the Panorama virtual appliance to Panorama mode.
     2. Set up a Panorama Virtual Appliance in Panorama Mode.
     3. Configure a Managed Collector.
   • For Panorama in Management Only mode.
     1. Set up a Panorama Virtual Appliance in Management Only Mode.
     2. Configure a Managed Collector to add a Dedicated Log Collector to the Panorama virtual appliance.
        Management Only mode does not support local log collection, and requires a Dedicated Log Collector to store managed device logs.
   • For SD-WAN deployments.
     1. Increase the System Disk for Panorama on an ESXi Server
        To leverage SD-WAN on Panorama deployed on ESXi, you must increase the system disk to 224GB.
        You cannot migrate back to a 81GB system disk after successfully increasing the system disk to 224GB.
     2. Set up a Panorama Virtual Appliance in Management Only Mode.
     3. Add a Virtual Disk to Panorama on an ESXi Server.
        To leverage SD-WAN, you must add a single 2TB logging disk to Panorama in Management Only mode.