Install Panorama on AWS

How to deploy a Panorama™ virtual appliance and a virtual Dedicated Log Collector on Amazon Web Services.
You can now deploy Panorama™ and a Dedicated Log Collector on Amazon Web Services (AWS). Panorama deployed on AWS is Bring Your Own License (BYOL), supports all deployment modes (Panorama, Log Collector, and Management Only), and shares the same processes and functionality as the M-Series hardware appliances. For more information on Panorama modes, see Panorama Models.
  1. Log in to AWS Web Service console and select the EC2 Dashboard.
  2. Set up the VPC for your network needs.
    Whether you launch the Panorama virtual appliance in an existing VPC or you create a new VPC, the Panorama virtual appliance must be able to receive traffic from the EC2 instances and perform inbound and outbound communication between the VPC and the internet.
    Refer to the AWS VPC documentation for instructions on creating a VPC and setting it up for access.
    1. Create a new VPC or use an existing VPC. Refer to the AWS Getting Started documentation.
    2. Verify that the network and security components are appropriately defined.
      • Enable communication to the internet. The default VPC includes an internet gateway and, if you install the Panorama virtual appliance in the default subnet, the VPC can access to the internet.
      • Create subnets. Subnets are segments of the IP address range assigned to the VPC in which you can launch the EC2 instances. The Panorama virtual appliance must belong to the public subnet so that you can configure it to access the internet.
      • Create a Security Group as needed to manage inbound and outbound traffic from the EC2 instances or subnets.
      • Add routes to the route table for a private subnet to ensure that you can route traffic can be routed across subnets and security groups in the VPC as applicable.
  3. Deploy Panorama on Amazon Web Services.
    1. On the EC2 Dashboard, click
      Instances
      Launch Instance
      .
    2. Select
      AWS Marketplace
      , search for
      Palo Alto Networks Panorama
      , and
      Select
      the Panorama AMI and
      Continue
      .
    3. Choose the
      EC2 instance type
      for allocating the resources required for the Panorama virtual appliance, and click
      Next: Configure Instance Details
      . Review the Setup Prerequisites for the Panorama Virtual Appliance for resource requirements.
      If you plan to use the Panorama virtual appliance as a Dedicated Log Collector, ensure that you configure the appliance with the required resources during initial deployment. The Panorama virtual appliance does not remain in Log Collector mode if you resize the virtual machine after you deploy it, and this results in a loss of log data.
    4. Select the VPC.
    5. Select the public subnet for the Panorama virtual appliance management interface.
    6. Automatically assign a public IP address
      . This IP must be accessible by the devices you plan to manage using Panorama. This allows you to obtain a publicly accessible IP address for the management interface of the Panorama virtual appliance. You can later attach an Elastic IP address to the management interface. Unlike the public IP address that is disassociated from the virtual appliance when the instance is terminated, the Elastic IP address provides persistence and you can the IP address to a new (or replacement) instance of the Panorama virtual appliance without the need to reconfigure the IP address wherever you
    7. Click
      Next: Add Storage
      and
      Add New Volume
      to add log storage. By default, the 81GB system disk is automatically created during the initial deployment.
      If you intend to use the Panorama virtual appliance in Panorama mode or as a Dedicated Log Collector, add the virtual logging disks during the initial deployment. By default, the Panorama virtual appliance is in Panorama mode for the initial deployment when you meet the Panorama mode resource requirements and have added at least one virtual logging disk. Otherwise, the Panorama virtual appliance defaults to Management Only mode. Change the Panorama virtual appliance to Management Only mode if you just want to manage devices and Dedicated Log Collectors, and to not collect logs locally.
      The Panorama virtual appliance on AWS only supports 2TB logging disks, and in total supports up to 24TB of log storage. You are unable to add a logging disk smaller than 2TB, or a logging disk with a size not divisible by the 2TB logging disk requirement. The Panorama virtual appliance partitions logging disks larger than 2TB into 2TB partitions.
    8. (
      Optional
      ) Add one or more tags as metadata to help you identify and group the Panorama virtual appliance. For example, add a
      Name
      tag with a
      Value
      that helps you identify which firewalls the Panorama virtual appliance manages.
    9. Create a new
      Security Group
      or select an existing one with HTTPS and SSH enabled at a minimum. This security group is for restricting access to the management interface.
    10. Select
      Review and Launch
      and verify that your selections are accurate before you
      Launch.
    11. Select an existing key pair or create a new one and acknowledge the disclaimer.
      If you created a new key, download and save the private key to a safe location. The file extension is
      .pem
      . You cannot regenerate this key if lost.
      It takes about 30 minutes to finish deploying the Panorama virtual appliance after you launch it on AWS. Deploying the Panorama virtual appliance may take longer depending on the number and size of the disks attached to the instance. View the Launch Time by selecting the Panorama virtual appliance instance (
      Instances
      ).
      aws-launch-time.png
      If you plan to use the Panorama virtual appliance as a Dedicated Log Collector, ensure that you the appliance with the required resources. The Panorama virtual appliance does not remain in Log Collector mode if you resize the virtual machine after you deploy it, and this results in a loss of log data.
  4. Shut down the Panorama virtual appliance.
    1. On the EC2 Dashboard, select
      Instances
      .
    2. Select the Panorama virtual appliance and click
      Actions
      Instance State
      Stop
      .
  5. Create or assign an Elastic IP (EIP) address to the management interface.
    Only the management interface is supported for log collection and device management.
    1. In the AWS Console, select
      Elastic IPs
      and
      Allocate New Address
      .
    2. Click
      Allocate
      to generate a new EIP address, click
      Actions
      , and
      Associate address
      .
    3. Select
      Instance
      , select the Panorama virtual appliance instance to which to assign the EIP address, and enter the
      Private IP address
      associated with the management interface and click
      Associate
      .
  6. Power on the Panorama virtual appliance.
    1. On the EC2 Dashboard, select
      Instance
      .
    2. From the list, select the Panorama virtual appliance and click
      Actions
      Instance State
      Start
      .
  7. Configure a new administrative password for the Panorama virtual appliance.
    You must configure a unique administrative password before you can access the web interface of the Panorama virtual appliance. To access the CLI, the private key used to launch the Panorama virtual appliance is required.
    • If you have an SSH service installed on your computer:
    1. Enter the following command to log into the Panorama virtual appliance:
      ssh -i
      <private_key.ppk>
      admin@<public-ip_address>
    2. Configure a new password using the following commands and follow the on screen prompts:
      admin>
      configure
      admin#
      set mgt-config users admin password
    3. If you need to activate a BYOL, set the DNS server IP address so that the Panorama virtual appliance can access the Palo Alto Networks licensing server. Enter the following command to set the DNS server IP address:
      admin#
      set deviceconfig system dns-setting servers primary
      <ip_address>
    4. Commit your changes with the command:
      admin#
      commit
    5. Terminate the SSH session.
    • If you are using PuTTY to SSH into the Panorama virtual appliance:
    1. If you are using an existing key pair and have the
      .ppk
      file available, continue to the Step 7.3. If you created a new key pair or have only the
      .pem
      file of the existing key pair, open PuTTYgen and
      Load
      the
      .pem
      file.
    2. Save the private key
      to a local accessible destination.
    3. Open PuTTY and select
      SSH
      Auth
      and then
      Browse
      to the
      .ppk
      file you saved in the previous step.
      browse-ppk.png
    4. Select
      Sessions
      and enter the public IP address of the Panorama virtual appliance. Click
      Open
      and click
      Yes
      when the security prompt appears.
    5. Log in as admin when prompted.
    6. Configure a new password using the following commands and follow the onscreen prompts:
      admin>
      configure
      admin#
      set mgt-config users admin password
    7. Set the DNS server IP address so that the Panorama virtual appliance can access the Palo Alto Networks licensing server. Enter the following command to set the DNS server IP address:
      admin#
      set deviceconfig system dns-setting servers primary
      <ip_address>
    8. Commit your changes with the command:
      admin#
      commit
    9. Terminate the SSH session.
  8. Complete configuring the Panorama virtual appliance for your deployment needs.

Related Documentation