Configure Panorama for Network Segmentation

To offload Panorama services from the MGT interface to other interfaces, start by configuring the interfaces on the Panorama management server. If your network has heavy log traffic, remember that the Eth4 and Eth5 interfaces on the M-500 and M-600 appliances support higher throughput (10Gbps) than the other interfaces (1Gbps). Then, configure the Log Collectors in each subnetwork to connect with specific interfaces on Panorama. For each Log Collector, you also select an interface for Collector Group communication and one or more interfaces for collecting logs from firewalls. Finally, configure the firewalls in each subnetwork to connect with interfaces on Panorama.
Palo Alto Networks recommends that you specify the IP address, netmask (for IPv4) or prefix length (for IPv6), and default gateway for the MGT interface. If you omit one of these settings (such as the default gateway), you can access the M-Series appliance only through the console port for future configuration changes.
Perform the following steps to configure Panorama and Dedicated Log Collectors to use multiple interfaces:
  1. Verify that the Panorama appliances and firewalls support multiple interfaces, and have the prerequisite software versions and configurations.
  2. Configure the interfaces on the solitary (non-HA) or active (HA) Panorama management server.
    Because the MGT interface was configured during initial Panorama configuration, you don’t have to configure it again.
    Perform these steps for each interface:
    1. Log in to the Panorama Web Interface of the solitary (non-HA) or active (HA) Panorama management server.
    2. Select
      Panorama
      Setup
      Interfaces
      .
    3. Click an Interface Name to edit the interface.
    4. Select
      <interface-name>
      to enable the interface.
    5. Configure one or both of these field sets based on the IP protocols of your network:
      • IPv4—
        IP Address
        ,
        Netmask
        , and
        Default Gateway
      • IPv6—
        IPv6 Address/Prefix Length
        and
        Default IPv6 Gateway
    6. Select the services that the interface supports:
      • Device Management and Device Log Collection
        —Manage firewalls, Log Collectors, and WildFire appliances and appliance clusters, collect logs that the Log Collectors generate, and query the Log Collectors for report information. To support a segmented network, you can enable these services on multiple interfaces.
      • Collector Group Communication
        —Communicate with the Collector Groups that Panorama manages across all subnetworks.
      • Device Deployment
        —Deploy software and content updates to managed firewalls, Log Collectors, and WildFire appliances and appliance clusters across all subnetworks.
    7. Click
      OK
      to save your changes to the interface.
    8. Click
      Commit
      Commit to Panorama
      and
      Commit
      your changes.
    9. Click
      Commit
      Push to Devices
      and push the changes to the Collector Group that contain the Log Collectors you modified.
  3. (
    HA only
    ) Configure the interfaces on the passive Panorama management server.
    1. Log in to the Panorama Web Interface of the active Panorama management server.
    2. Select
      Panorama
      Managed Collectors
      and select the passive HA peer.
    3. Select
      Interfaces
      and click an interface to edit.
    4. Check the
      Enable Interface
      box to enable the interface.
    5. Configure one or both of these field sets based on the IP protocols of your network:
      • IPv4—
        IP Address
        ,
        Netmask
        , and
        Default Gateway
      • IPv6—
        IPv6 Address/Prefix Length
        and
        Default IPv6 Gateway
    6. Select the services that the interface supports:
      • Device Management and Device Log Collection
        —Manage firewalls, Log Collectors, and WildFire appliances and appliance clusters, collect logs that the Log Collectors generate, and query the Log Collectors for report information. To support a segmented network, you can enable these services on multiple interfaces.
      • Collector Group Communication
        —Communicate with the Collector Groups that Panorama manages across all subnetworks.
      • Device Deployment
        —Deploy software and content updates to managed firewalls, Log Collectors, and WildFire appliances and appliance clusters across all subnetworks.
    7. Click
      OK
      to save your changes to the interface.
    8. Select
      Commit
      Commit and Push
      to commit your changes to Panorama and to push the changes to Collector Groups that contain the passive HA peer you modified.
  4. Configure each Log Collector to connect with a Panorama interface.
    To support a segmented network, you can connect the Log Collectors in each subnetwork to separate Panorama interfaces. The interfaces must have
    Device Management and Device Log Collection
    enabled, as described in the previous step.
    1. Log in to the Panorama Web Interface of the solitary (non-HA) or active (HA) Panorama management server.
    2. Select
      Panorama
      Managed Collectors
      and edit the Log Collector.
    3. In the
      Panorama Server IP
      field, enter the IP address of an interface on the solitary (non-HA) or active (HA) Panorama.
    4. (
      HA only
      ) In the
      Panorama Server IP 2
      field, enter the IP address of an interface on the passive Panorama that will support
      Device Management and Device Log Collection
      if failover occurs on the active Panorama.
    5. Click
      OK
      to save your changes.
    6. Select
      Commit
      Commit and Push
      to commit your changes to Panorama and to push the changes to Collector Groups that contain the Log Collector you modified.
    7. Perform the following steps on each Dedicated Log Collector:
      1. Access the Log Collector CLI by using emulation software such as PuTTY to open a SSH session to the Log Collector using its MGT interface IP address. When prompted, log in using Panorama administrator credentials.
      2. Run the following commands, where
        <IPaddress1>
        is for the solitary (non-HA) or active (HA) Panorama and
        <IPaddress2>
        is for the passive Panorama (if applicable).
        >
        configure
        #
        set deviceconfig system panorama-server
        <IPaddress1>
        panorama-server-2
        <IPaddress2>
        #
        commit
  5. (
    HA only
    ) Configure an interface on the passive Panorama management server to deploy updates in case the active Panorama fails over.
    1. Log in to the Panorama Web Interface of the passive Panorama management server.
    2. Select
      Panorama
      Setup
      Interfaces
      .
    3. Click an Interface Name to edit the interface.
    4. Select
      <interface-name>
      to enable the interface.
    5. Configure one or both of these field sets based on the IP protocols of your network:
      • IPv4—
        IP Address
        ,
        Netmask
        , and
        Default Gateway
      • IPv6—
        IPv6 Address/Prefix Length
        and
        Default IPv6 Gateway
    6. Select
      Device Deployment
      .
    7. Click
      OK
      to save your changes.
    8. Click
      Commit
      Commit to Panorama
      and
      Commit
      your changes.
  6. Configure the interfaces that the Log Collectors will use to collect logs from firewalls and communicate with other Log Collectors.
    Because the MGT interface was configured during initial configuration of the Log Collectors, you don’t have to configure it again.
    1. Log in to the Panorama Web Interface of the solitary (non-HA) or active (HA) Panorama management server.
    2. Select
      Panorama
      Managed Collectors
      and edit the Log Collector.
    3. Select
      Interfaces
      and perform the following steps for each interface:
      1. Click an interface name to edit that interface.
      2. Select
        <interface-name>
        to enable the interface.
      3. Configure one or both of the following field sets based on the IP protocols of your network.
        I
        Pv4
        IP Address
        ,
        Netmask
        , and
        Default Gateway
        IPv6
        IPv6 Address/Prefix Length
        and
        Default IPv6 Gateway
      4. Select the functions that the interface supports:
        Device Log Collection
        —Collect logs from firewalls. You can load balance the logging traffic by enabling multiple interfaces to perform this function.
        Collector Group Communication
        —Communicate with other Log Collectors in the Collector Group.
      5. Click
        OK
        to save your changes to the interface.
    4. Click
      OK
      to save your changes to the Log Collector.
    5. Select
      Commit
      Commit and Push
      to commit your changes to Panorama and to push the changes to Collector Groups that contain the Log Collectors you modified.
    6. Select
      Panorama
      Managed Collectors
      to verify that the Log Collectors are synchronized and connected with Panorama.
      The Configuration Status column should display
      InSync
      and the Run Time Status column should display
      connected
      .
  7. Configure the firewalls to connect with a Panorama interface.
    To support a segmented network, you can connect the firewalls in each subnetwork to separate Panorama interfaces. The interfaces must have
    Device Management and Device Log Collection
    enabled. This step assumes that you use separate templates to configure the firewalls in separate subnetworks.
    In this example deployment, Panorama uses these interfaces to manage the firewalls but not to collect firewall logs. You specify which Dedicated Log Collectors will collect firewall logs when you configure Collector Groups.
    1. Log in to the Panorama Web Interface of the solitary (non-HA) or active (HA) Panorama management server.
    2. On Panorama, select
      Device
      Setup
      Management
      , select a
      Template
      and edit the Panorama Settings.
    3. In the first
      Panorama Servers
      field, enter the IP address of an interface on the solitary (non-HA) or active (HA) Panorama.
    4. (
      HA only
      ) In the second
      Panorama Servers
      field, enter the IP address of an interface on the passive Panorama that will support device management if failover occurs.
    5. Click
      OK
      to save your changes.
    6. Select
      Commit
      Commit and Push
      to commit your changes to Panorama and push the template changes to firewalls.
    7. Select
      Panorama
      Managed Devices
      to verify that the firewalls are synchronized and connected with Panorama.
      The Device State column should display
      Connected
      . The Shared Policy and Template columns should display
      InSync
      .

Related Documentation