Configure Panorama for Network Segmentation
Table of Contents
11.1 & Later
Expand all | Collapse all
-
- Determine Panorama Log Storage Requirements
-
- Setup Prerequisites for the Panorama Virtual Appliance
- Perform Initial Configuration of the Panorama Virtual Appliance
- Set Up The Panorama Virtual Appliance as a Log Collector
- Set Up the Panorama Virtual Appliance with Local Log Collector
- Set up a Panorama Virtual Appliance in Panorama Mode
- Set up a Panorama Virtual Appliance in Management Only Mode
-
- Preserve Existing Logs When Adding Storage on Panorama Virtual Appliance in Legacy Mode
- Add a Virtual Disk to Panorama on an ESXi Server
- Add a Virtual Disk to Panorama on vCloud Air
- Add a Virtual Disk to Panorama on Alibaba Cloud
- Add a Virtual Disk to Panorama on AWS
- Add a Virtual Disk to Panorama on Azure
- Add a Virtual Disk to Panorama on Google Cloud Platform
- Add a Virtual Disk to Panorama on KVM
- Add a Virtual Disk to Panorama on Hyper-V
- Add a Virtual Disk to Panorama on Oracle Cloud Infrastructure (OCI)
- Mount the Panorama ESXi Server to an NFS Datastore
-
- Increase CPUs and Memory for Panorama on an ESXi Server
- Increase CPUs and Memory for Panorama on vCloud Air
- Increase CPUs and Memory for Panorama on Alibaba Cloud
- Increase CPUs and Memory for Panorama on AWS
- Increase CPUs and Memory for Panorama on Azure
- Increase CPUs and Memory for Panorama on Google Cloud Platform
- Increase CPUs and Memory for Panorama on KVM
- Increase CPUs and Memory for Panorama on Hyper-V
- Increase the CPUs and Memory for Panorama on Oracle Cloud Infrastructure (OCI)
- Complete the Panorama Virtual Appliance Setup
-
- Convert Your Evaluation Panorama to a Production Panorama with Local Log Collector
- Convert Your Evaluation Panorama to a Production Panorama without Local Log Collector
- Convert Your Evaluation Panorama to VM-Flex Licensing with Local Log Collector
- Convert Your Evaluation Panorama to VM-Flex Licensing without Local Log Collector
- Convert Your Production Panorama to an ELA Panorama
-
- Register Panorama
- Activate a Panorama Support License
- Activate/Retrieve a Firewall Management License when the Panorama Virtual Appliance is Internet-connected
- Activate/Retrieve a Firewall Management License when the Panorama Virtual Appliance is not Internet-connected
- Activate/Retrieve a Firewall Management License on the M-Series Appliance
- Install the Panorama Device Certificate
- Install the Device Certificate for a Dedicated Log Collector
-
- Migrate from a Panorama Virtual Appliance to an M-Series Appliance
- Migrate a Panorama Virtual Appliance to a Different Hypervisor
- Migrate from an M-Series Appliance to a Panorama Virtual Appliance
- Migrate from an M-500 Appliance to an M-700 Appliance
- Migrate from an M-600 Appliance to an M-700 Appliance
- Migrate from an M-100 Appliance to an M-500 Appliance
- Migrate from an M-100 or M-500 Appliance to an M-200 or M-600 Appliance
-
- Configure an Admin Role Profile
- Configure an Admin Role Profile for Selective Push to Managed Firewalls
- Configure an Access Domain
-
- Configure a Panorama Administrator Account
- Configure Local or External Authentication for Panorama Administrators
- Configure a Panorama Administrator with Certificate-Based Authentication for the Web Interface
- Configure an Administrator with SSH Key-Based Authentication for the CLI
- Configure RADIUS Authentication for Panorama Administrators
- Configure TACACS+ Authentication for Panorama Administrators
- Configure SAML Authentication for Panorama Administrators
- Enable SCP Uploads for an Administrator
- Configure Tracking of Administrator Activity
-
- Add a Firewall as a Managed Device
- Change Between Panorama Management and Cloud Management
-
- Add a Device Group
- Create a Device Group Hierarchy
- Create Objects for Use in Shared or Device Group Policy
- Revert to Inherited Object Values
- Manage Unused Shared Objects
- Manage Precedence of Inherited Objects
- Move or Clone a Policy Rule or Object to a Different Device Group
- Push a Policy Rule to a Subset of Firewalls
- Device Group Push to a Multi-VSYS Firewall
- Manage the Rule Hierarchy
- Manage the Master Key from Panorama
- Schedule a Configuration Push to Managed Firewalls
- Redistribute Data to Managed Firewalls
-
- Plan the Transition to Panorama Management
- Migrate a Firewall to Panorama Management and Reuse Existing Configuration
- Migrate a Firewall to Panorama Management and Push a New Configuration
- Migrate a Firewall HA Pair to Panorama Management and Reuse Existing Configuration
- Migrate a Firewall HA Pair to Panorama Management and Push a New Configuration
- Load a Partial Firewall Configuration into Panorama
- Localize a Panorama Pushed Configuration on a Managed Firewall
-
- Configure a Managed Collector
- Monitor Managed Collector Health Status
- Configure Log Forwarding to Panorama
- Configure Syslog Forwarding to External Destinations
- Forward Logs to Strata Logging Service
- Verify Log Forwarding to Panorama
- Modify Log Forwarding and Buffering Defaults
- Configure Log Forwarding from Panorama to External Destinations
-
- Add Standalone WildFire Appliances to Manage with Panorama
- Remove a WildFire Appliance from Panorama Management
-
-
- Configure a Cluster and Add Nodes on Panorama
- Configure General Cluster Settings on Panorama
- Remove a Cluster from Panorama Management
- Configure Appliance-to-Appliance Encryption Using Predefined Certificates Centrally on Panorama
- Configure Appliance-to-Appliance Encryption Using Custom Certificates Centrally on Panorama
- View WildFire Cluster Status Using Panorama
-
-
- Preview, Validate, or Commit Configuration Changes
- Commit Selective Configuration Changes for Managed Devices
- Push Selective Configuration Changes to Managed Devices
- Enable Automated Commit Recovery
- Compare Changes in Panorama Configurations
- Manage Locks for Restricting Configuration Changes
- Add Custom Logos to Panorama
- Use the Panorama Task Manager
- Reboot or Shut Down Panorama
- Configure Panorama Password Profiles and Complexity
-
-
- Verify Panorama Port Usage
- Resolve Zero Log Storage for a Collector Group
- Replace a Failed Disk on an M-Series Appliance
- Replace the Virtual Disk on an ESXi Server
- Replace the Virtual Disk on vCloud Air
- Migrate Logs to a New M-Series Appliance in Log Collector Mode
- Migrate Logs to a New M-Series Appliance in Panorama Mode
- Migrate Logs to a New M-Series Appliance Model in Panorama Mode in High Availability
- Migrate Logs to the Same M-Series Appliance Model in Panorama Mode in High Availability
- Migrate Log Collectors after Failure/RMA of Non-HA Panorama
- Regenerate Metadata for M-Series Appliance RAID Pairs
- View Log Query Jobs
- Troubleshoot Registration or Serial Number Errors
- Troubleshoot Reporting Errors
- Troubleshoot Device Management License Errors
- Troubleshoot Automatically Reverted Firewall Configurations
- View Task Success or Failure Status
- Generate a Stats Dump File for a Managed Firewall
- Recover Managed Device Connectivity to Panorama
- Restore an Expired Device Certificate
Configure Panorama for Network Segmentation
To offload Panorama services from the MGT
interface to other interfaces, start by configuring the interfaces
on the Panorama management server. If your network has heavy log
traffic, remember that the Eth4 and Eth5 interfaces on the M-500,
M-600, and M-700 appliances support higher throughput (10Gbps) than
the other interfaces (1Gbps). Then, configure the Log Collectors
in each subnetwork to connect with specific interfaces on Panorama.
For each Log Collector, you also select an interface for Collector
Group communication and one or more interfaces for collecting logs
from firewalls. Finally, configure the firewalls in each subnetwork
to connect with interfaces on Panorama.
If you are configuring
an M-Series appliance in Log Collector mode with 10GB interfaces,
you must complete this entire configuration procedure for the 10GB
interfaces to display as
Up
. Palo Alto Networks recommends that you
specify the IP address, netmask (for IPv4) or prefix length (for
IPv6), and default gateway for the MGT interface. If you omit one
of these settings (such as the default gateway), you can access
the M-Series appliance only through the console port for future
configuration changes.
Perform the following steps
to configure Panorama and Dedicated Log Collectors to use multiple
interfaces:
- Verify that the Panorama appliances and firewalls support multiple interfaces, and have the prerequisite software versions and configurations.
- The M-Series appliances must run Panorama 8.0 or later to use a separate interface for deploying updates and to use multiple interfaces for device management and log collection. The M-200 and M-600 appliances must run Panorama 8.1 or later while the M-300 and M-700 must run Panorama 11.1 or later. Panorama appliances deployed on ESXi, vCloud, Air, Hyper-V and KVM must run Panorama 8.1 or later.
- If you deployed a Panorama or Log Collector as a virtual appliance, verify the Supported Interfaces for the Panorama Virtual Appliance.
- The M-Series appliances must run Panorama 6.1 or later to use separate interfaces for log collection or Collector Group communication.
- The initial configuration of each Panorama management server is complete. This includes configuration of the MGT interface.To configure an IPv6 IP address for the Panorama MGT interface, you must configure both an IPv4 and IPv6 to successfully configure Panorama using an IPv6 IP address. Panorama does not support configuring the MGT interface with only an IPv6 IP address.
- Log Collectors and Collector Groups are configured. This includes configuration of the MGT interface on the Log Collectors.To configure an IPv6 IP address for the MGT interface of a Log Collector, you must configure both an IPv4 and IPv6 to successfully configure Panorama using an IPv6 IP address. Panorama does not support configuring the MGT interface with only an IPv6 IP address.
- The initial configuration of the firewalls is complete, you have added the firewalls to Panorama as managed devices, and the firewalls in each subnetwork are assigned to a separate template.
- The initial configuration of WildFire appliances is complete and you have added WildFire appliances to Panorama as managed devices.
- Configure the interfaces on the solitary (non-HA) or active (HA) Panorama management server.Because the MGT interface was configured during initial Panorama configuration, you don’t have to configure it again.Perform these steps for each interface:
- Log in to the Panorama Web Interface of the solitary (non-HA) or active (HA) Panorama management server.
- Select.PanoramaSetupInterfaces
- Click an Interface Name to edit the interface.
- Select<interface-name>to enable the interface.
- Configure one or both of these field sets based on the IP protocols of your network:
- IPv4—IP Address,Netmask, andDefault Gateway
- IPv6—IPv6 Address/Prefix LengthandDefault IPv6 Gateway
- Select the services that the interface supports:
- Device Management and Device Log Collection—Manage firewalls, Log Collectors, and WildFire appliances and appliance clusters, collect logs that the Log Collectors generate, and query the Log Collectors for report information. To support a segmented network, you can enable these services on multiple interfaces.
- Collector Group Communication—Communicate with the Collector Groups that Panorama manages across all subnetworks.
- Device Deployment—Deploy software and content updates to managed firewalls, Log Collectors, and WildFire appliances and appliance clusters across all subnetworks.
- ClickOKto save your changes to the interface.
- ClickandCommitCommit to PanoramaCommityour changes.
- Clickand push the changes to the Collector Group that contain the Log Collectors you modified.CommitPush to Devices
- (HA only) Configure the interfaces on the passive Panorama management server.
- Log in to the Panorama Web Interface of the active Panorama management server.
- Selectand select the passive HA peer.PanoramaManaged Collectors
- SelectInterfacesand click an interface to edit.
- Check theEnable Interfacebox to enable the interface.
- Configure one or both of these field sets based on the IP protocols of your network:
- IPv4—IP Address,Netmask, andDefault Gateway
- IPv6—IPv6 Address/Prefix LengthandDefault IPv6 Gateway
- Select the services that the interface supports:
- Device Management and Device Log Collection—Manage firewalls, Log Collectors, and WildFire appliances and appliance clusters, collect logs that the Log Collectors generate, and query the Log Collectors for report information. To support a segmented network, you can enable these services on multiple interfaces.
- Collector Group Communication—Communicate with the Collector Groups that Panorama manages across all subnetworks.
- Device Deployment—Deploy software and content updates to managed firewalls, Log Collectors, and WildFire appliances and appliance clusters across all subnetworks.
- ClickOKto save your changes to the interface.
- Selectto commit your changes to Panorama and to push the changes to Collector Groups that contain the passive HA peer you modified.CommitCommit and Push
- Configure each Log Collector to connect with a Panorama interface.To support a segmented network, you can connect the Log Collectors in each subnetwork to separate Panorama interfaces. The interfaces must haveDevice Management and Device Log Collectionenabled, as described in the previous step.
- Log in to the Panorama Web Interface of the solitary (non-HA) or active (HA) Panorama management server.
- Selectand edit the Log Collector.PanoramaManaged Collectors
- In thePanorama Server IPfield, enter the IP address of an interface on the solitary (non-HA) or active (HA) Panorama.
- (HA only) In thePanorama Server IP 2field, enter the IP address of an interface on the passive Panorama that will supportDevice Management and Device Log Collectionif failover occurs on the active Panorama.
- ClickOKto save your changes.
- Selectto commit your changes to Panorama and to push the changes to Collector Groups that contain the Log Collector you modified.CommitCommit and Push
- Perform the following steps on each Dedicated Log Collector:
- Access the Log Collector CLI by using emulation software such as PuTTY to open a SSH session to the Log Collector using its MGT interface IP address. When prompted, log in using Panorama administrator credentials.
- Run the following commands, where<IPaddress1>is for the solitary (non-HA) or active (HA) Panorama and<IPaddress2>is for the passive Panorama (if applicable).>configure#set deviceconfig system panorama-server#<IPaddress1>panorama-server-2<IPaddress2>commit
- (HA only) Configure an interface on the passive Panorama management server to deploy updates in case the active Panorama fails over.
- Log in to the Panorama Web Interface of the passive Panorama management server.
- Select.PanoramaSetupInterfaces
- Click an Interface Name to edit the interface.
- Select<interface-name>to enable the interface.
- Configure one or both of these field sets based on the IP protocols of your network:
- IPv4—IP Address,Netmask, andDefault Gateway
- IPv6—IPv6 Address/Prefix LengthandDefault IPv6 Gateway
- SelectDevice Deployment.
- ClickOKto save your changes.
- ClickandCommitCommit to PanoramaCommityour changes.
- Configure the interfaces that the Log Collectors will use to collect logs from firewalls and communicate with other Log Collectors.Because the MGT interface was configured during initial configuration of the Log Collectors, you don’t have to configure it again.
- Log in to the Panorama Web Interface of the solitary (non-HA) or active (HA) Panorama management server.
- Selectand edit the Log Collector.PanoramaManaged Collectors
- SelectInterfacesand perform the following steps for each interface:
- Click an interface name to edit that interface.
- Select<interface-name>to enable the interface.
- Configure one or both of the following field sets based on the IP protocols of your network.IPv4—IP Address,Netmask, andDefault GatewayIPv6—IPv6 Address/Prefix LengthandDefault IPv6 Gateway
- Select the functions that the interface supports:Device Log Collection—Collect logs from firewalls. You can load balance the logging traffic by enabling multiple interfaces to perform this function.Collector Group Communication—Communicate with other Log Collectors in the Collector Group.
- ClickOKto save your changes to the interface.
- ClickOKto save your changes to the Log Collector.
- Selectto commit your changes to Panorama and to push the changes to Collector Groups that contain the Log Collectors you modified.CommitCommit and Push
- Selectto verify that the Log Collectors are synchronized and connected with Panorama.PanoramaManaged CollectorsThe Configuration Status column should displayInSyncand the Run Time Status column should displayconnected.
- Configure the firewalls to connect with a Panorama interface.To support a segmented network, you can connect the firewalls in each subnetwork to separate Panorama interfaces. The interfaces must haveDevice Management and Device Log Collectionenabled. This step assumes that you use separate templates to configure the firewalls in separate subnetworks.In this example deployment, Panorama uses these interfaces to manage the firewalls but not to collect firewall logs. You specify which Dedicated Log Collectors will collect firewall logs when you configure Collector Groups.
- Log in to the Panorama Web Interface of the solitary (non-HA) or active (HA) Panorama management server.
- On Panorama, select, select aDeviceSetupManagementTemplateand edit the Panorama Settings.
- In the firstPanorama Serversfield, enter the IP address of an interface on the solitary (non-HA) or active (HA) Panorama.
- (HA only) In the secondPanorama Serversfield, enter the IP address of an interface on the passive Panorama that will support device management if failover occurs.
- ClickOKto save your changes.
- Selectto commit your changes to Panorama and push the template changes to firewalls.CommitCommit and Push
- Selectto verify that the firewalls are synchronized and connected with Panorama.PanoramaManaged DevicesThe Device State column should displayConnected. The Shared Policy and Template columns should displayInSync.