Install Panorama on AWS

How to deploy a Panorama™ virtual appliance and a virtual Dedicated Log Collector on Amazon Web Services.
You can now deploy Panorama™ and a Dedicated Log Collector on Amazon Web Services (AWS). Panorama deployed on AWS is Bring Your Own License (BYOL), supports all deployment modes (Panorama, Log Collector, and Management Only), and shares the same processes and functionality as the M-Series hardware appliances. For more information on Panorama modes, see Panorama Models.
  1. Log in to AWS Web Service console and select the EC2 Dashboard.
  2. Set up the VPC for your network needs.
    Whether you launch the Panorama virtual appliance in an existing VPC or you create a new VPC, the Panorama virtual appliance must be able to receive traffic from the EC2 instances and perform inbound and outbound communication between the VPC and the internet.
    Refer to the AWS VPC documentation for instructions on creating a VPC and setting it up for access.
    1. Create a new VPC or use an existing VPC. Refer to the AWS Getting Started documentation.
    2. Verify that the network and security components are appropriately defined.
      • Enable communication to the internet. The default VPC includes an internet gateway and, if you install the Panorama virtual appliance in the default subnet, the VPC can access to the internet.
      • Create subnets. Subnets are segments of the IP address range assigned to the VPC in which you can launch the EC2 instances. The Panorama virtual appliance must belong to the public subnet so that you can configure it to access the internet.
      • Create a Security Group as needed to manage inbound and outbound traffic from the EC2 instances or subnets.
      • Add routes to the route table for a private subnet to ensure that you can route traffic can be routed across subnets and security groups in the VPC as applicable.
  3. Deploy Panorama on Amazon Web Services.
    1. On the EC2 Dashboard, click InstancesLaunch Instance.
    2. Select AWS Marketplace, search for Palo Alto Networks Panorama, and Select the Panorama AMI and Continue.
    3. Choose the EC2 instance type for allocating the resources required for the Panorama virtual appliance, and click Next: Configure Instance Details. Review the Setup Prerequisites for the Panorama Virtual Appliance for resource requirements.
      If you plan to use the Panorama virtual appliance as a Dedicated Log Collector, ensure that you configure the appliance with the required resources during initial deployment. The Panorama virtual appliance does not remain in Log Collector mode if you resize the virtual machine after you deploy it, and this results in a loss of log data.
    4. Select the VPC.
    5. Select the public subnet for the Panorama virtual appliance management interface.
    6. Automatically assign a public IP address. This IP must be accessible by the devices you plan to manage using Panorama. This allows you to obtain a publicly accessible IP address for the management interface of the Panorama virtual appliance. You can later attach an Elastic IP address to the management interface. Unlike the public IP address that is disassociated from the virtual appliance when the instance is terminated, the Elastic IP address provides persistence and you can the IP address to a new (or replacement) instance of the Panorama virtual appliance without the need to reconfigure the IP address wherever you
    7. Click Next: Add Storage and Add New Volume to add log storage. By default, the 81GB system disk is automatically created during the initial deployment.
      If you intend to use the Panorama virtual appliance in Panorama mode or as a Dedicated Log Collector, add the virtual logging disks during the initial deployment. By default, the Panorama virtual appliance is in Panorama mode for the initial deployment when you meet the Panorama mode resource requirements and have added at least one virtual logging disk. Otherwise, the Panorama virtual appliance defaults to Management Only mode. Change the Panorama virtual appliance to Management Only mode if you just want to manage devices and Dedicated Log Collectors, and to not collect logs locally.
      The Panorama virtual appliance on AWS only supports 2TB logging disks, and in total supports up to 24TB of log storage. You are unable to add a logging disk smaller than 2TB, or a logging disk with a size not divisible by the 2TB logging disk requirement. The Panorama virtual appliance partitions logging disks larger than 2TB into 2TB partitions.
    8. (Optional) Add one or more tags as metadata to help you identify and group the Panorama virtual appliance. For example, add a Name tag with a Value that helps you identify which firewalls the Panorama virtual appliance manages.
    9. Create a newSecurity Group or select an existing one with HTTPS and SSH enabled at a minimum. This security group is for restricting access to the management interface.
    10. Select Review and Launch and verify that your selections are accurate before you Launch.
    11. Select an existing key pair or create a new one and acknowledge the disclaimer.
      If you created a new key, download and save the private key to a safe location. The file extension is .pem. You cannot regenerate this key if lost.
      It takes about 30 minutes to finish deploying the Panorama virtual appliance after you launch it on AWS. Deploying the Panorama virtual appliance may take longer depending on the number and size of the disks attached to the instance. View the Launch Time by selecting the Panorama virtual appliance instance (Instances).
      aws-launch-time.png
      If you plan to use the Panorama virtual appliance as a Dedicated Log Collector, ensure that you the appliance with the required resources. The Panorama virtual appliance does not remain in Log Collector mode if you resize the virtual machine after you deploy it, and this results in a loss of log data.
  4. Shut down the Panorama virtual appliance.
    1. On the EC2 Dashboard, select Instances.
    2. Select the Panorama virtual appliance and click ActionsInstance StateStop.
  5. Create or assign an Elastic IP (EIP) address to the management interface.
    Only the management interface is supported for log collection and device management.
    1. In the AWS Console, select Elastic IPs and Allocate New Address.
    2. Click Allocate to generate a new EIP address, click Actions, and Associate address.
    3. Select Instance, select the Panorama virtual appliance instance to which to assign the EIP address, and enter the Private IP address associated with the management interface and click Associate.
  6. Power on the Panorama virtual appliance.
    1. On the EC2 Dashboard, select Instance.
    2. From the list, select the Panorama virtual appliance and click ActionsInstance StateStart.
  7. Configure a new administrative password for the Panorama virtual appliance.
    You must configure a unique administrative password before you can access the web interface of the Panorama virtual appliance. To access the CLI, the private key used to launch the Panorama virtual appliance is required.
    • If you have an SSH service installed on your computer:
    1. Enter the following command to log into the Panorama virtual appliance:
      ssh -i <private_key.ppk> admin@<public-ip_address>
    2. Configure a new password using the following commands and follow the on screen prompts:
      admin> configure
      admin# set mgt-config users admin password
    3. If you need to activate a BYOL, set the DNS server IP address so that the Panorama virtual appliance can access the Palo Alto Networks licensing server. Enter the following command to set the DNS server IP address:
      admin# set deviceconfig system dns-setting servers primary <ip_address>
    4. Commit your changes with the command:
      admin# commit
    5. Terminate the SSH session.
    • If you are using PuTTY to SSH into the Panorama virtual appliance:
    1. If you are using an existing key pair and have the .ppk file available, continue to the Step 7.3. If you created a new key pair or have only the .pem file of the existing key pair, open PuTTYgen and Load the .pem file.
    2. Save the private key to a local accessible destination.
    3. Open PuTTY and select SSHAuth and then Browse to the .ppk file you saved in the previous step.
      browse-ppk.png
    4. Select Sessions and enter the public IP address of the Panorama virtual appliance. Click Open and click Yes when the security prompt appears.
    5. Log in as admin when prompted.
    6. Configure a new password using the following commands and follow the onscreen prompts:
      admin> configure
      admin# set mgt-config users admin password
    7. Set the DNS server IP address so that the Panorama virtual appliance can access the Palo Alto Networks licensing server. Enter the following command to set the DNS server IP address:
      admin# set deviceconfig system dns-setting servers primary <ip_address>
    8. Commit your changes with the command:
      admin# commit
    9. Terminate the SSH session.
  8. Activate the device management license and support license on the Panorama virtual appliance.
  9. Complete configuring the Panorama virtual appliance for your deployment needs.

Related Documentation