Focus

Panorama Administrator's Guide

Import Multiple ZTP Firewalls to Panorama

Table of Contents

Import Multiple ZTP Firewalls to Panorama

Import multiple ZTP firewalls to the Panorama™ management server in CSV format.

Log in to the web interface of the Panorama™ management server as a Superuser, Panorama admin, or as the ZTP installer admin to import multiple ZTP firewalls to Panorama. To import multiple ZTP firewalls, you must import a CSV file of the ZTP firewall serial number and corresponding claim key provided by Palo Alto Networks and then register the firewalls with the ZTP service. Registering the firewall claims the firewalls as assets in your account in the Customer Support Portal and allows the ZTP service to associate the firewalls with the Panorama.

Before you can successfully add a ZTP firewall to Panorama, you must ensure that a Dynamic Host Configuration Protocol (DHCP) server is deployed on the network. A DHCP server is required to successfully onboard a ZTP firewall to Panorama. The ZTP firewall is unable to connect to the Palo Alto Networks ZTP service to facilitate onboarding without a DHCP server.

Do not power on the ZTP firewall until after you finish all the required installation and setup procedures. This causes ZTP onboarding to fail and you must reset the firewall to factory default settings to restart the ZTP onboarding process.

Migrating a firewall added to Panorama management using ZTP from one Panorama to another is not supported.

Firewalls onboarded to Panorama management using ZTP do not support high availability (HA) configuration.

You must disable ZTP on your firewalls to configure them in an HA configuration. After disabling ZTP, add your firewalls as managed devices and set up your firewalls in an active/passive or active/active HA configuration.

While adding ZTP firewalls to Panorama, do not perform any commits on the ZTP firewall before you verify that the firewall is successfully added to Panorama. Performing a local commit on the ZTP firewall disables ZTP functionality and results in the failure to successfully add the firewall to Panorama.

11.2 and Later

11.1