Perform Initial Configuration of the Panorama Virtual Appliance
Based on your Panorama model, use the AWS, Azure,
or GCP web
interface, KVM Virtual Machine Manager, Hyper-V Manager, VMware
vSphere Client, or vCloud Air web console to set up network access
to the Panorama virtual appliance. By default, the Panorama virtual
appliance is deployed in Panorama mode. For unified reporting, consider
using Greenwich Mean Time (GMT) or Coordinated Universal Time (UTC)
as the uniform time zone across Panorama and all the managed firewalls
and Log Collectors.
- Gather the required information from your network administrator.Collect the following information for the management (MGT) interface:
- IP address for the management (MGT) interface
- Netmask
- Default gateway
- DNS server IP addressTo complete the configuration of the MGT interface, you must specify the IP address, netmask (for IPv4) or prefix length (for IPv6), and default gateway. If you omit settings (such as the default gateway), you can access Panorama only through the console port for future configuration changes. As a best practice, always commit a complete MGT interface configuration.
- Access the console of the Panorama virtual appliance.
- Access the console.On an ESXi server:
- Launch the VMware vSphere Client.
- Select theConsoletab for the Panorama virtual appliance and press enter to access the login screen.
On vCloud Air:- Access the vCloud Air web console and select yourVirtual Private Cloud OnDemandregion.
- Select theVirtual Machinestab, right-click the Panorama virtual machine, and selectOpen In Console.
- Enter your username and password to log in (default is admin for both).On AWS, Azure, GCP, KVM, and Hyper-V:
- Change the default administrator password.Starting with PAN-OS 9.0.4, the predefined, default administrator password (admin/admin) must be changed on the first login on a device. The new password must be a minimum of eight characters and include a minimum of one lowercase and one uppercase character, as well as one number or special character.Be sure to use the best practices for password strength to ensure a strict password and review the password complexity settings.To ensure that the management interface remains secure, configure the Minimum Password Complexity ().PanoramaSetupManagement
- Click theadminlink on the left side of the web interface footer.
- Enter theOld Passwordand theNew Passwordand record the new password in a safe location.
- ClickOK.
- Configure the network access settings for the MGT interface.Panorama uses the MGT interface for management traffic, high availability synchronization, log collection, and communication within Collector Groups.
- Enter the following commands, where<Panorama-IP>is the IP address you want to assign to the Panorama management interface,<netmask>is the subnet mask,<gateway-IP>is the IP address of the network gateway, and<DNS-IP>is the IP address of the DNS server:>configure#set deviceconfig system ip-address#<Panorama-IP>netmask<netmask>default-gateway<gateway-IP>dns-setting servers primary<DNS-IP>commit#exit
- Troubleshoot Connectivity to Network Resources to verify network access to external services required for firewall management, such as the default gateway, DNS server, and the Palo Alto Networks Update Server, as shown in the following example:
- Configure the general settings.
- Using a secure connection (HTTPS) from a web browser, log in to the Panorama web interface using the IP address and password you assigned to the management interface (https://<IP address>).
- Selectand edit the General Settings.PanoramaSetupManagement
- Enter aHostnamefor the server and enter the networkDomainname. The domain name is just a label; Panorama doesn’t use it to join the domain.
- Align the clock on Panorama and the managed firewalls to use the sameTime Zone, for example GMT or UTC. If you plan to use the Cortex Data Lake, you must configure NTP so that Panorama can stay in sync with the Cortex Data Lake.Timestamps are recorded when Panorama receives the logs and the managed firewalls generate the logs. Aligning the time zones on Panorama and the firewalls ensures that the timestamps are synchronized and the process of querying logs and generating reports on Panorama is harmonious.
- Enter theLatitudeandLongitudeto enable accurate placement of the Panorama management server on the world map.
- Enter theSerial Numberyou received in the order fulfillment email.
- ClickOKto save your changes.
- (Optional) Modify the management interface settings.
- Selectand clickPanoramaSetupInterfacesManagement.
- If your firewalls connect to the Panorama management server using a public IP address that is translated to a private IP address (NAT), enter the public IP in thePublic IP Addressfield, and the private IP in theIP Addressfield to push both addresses to your firewalls.
- Select which Network Connectivity Services to allow on the interface (such asSSHaccess).Don’t selectTelnetorHTTP. These services use plaintext and are less secure than the other services.
- ClickOKto save your changes to the interface.
- Commit your configuration changes.SelectandCommitCommit to PanoramaCommityour changes.
- Next steps...
- (Best Practice) Replace the default certificate that Panorama uses to secure HTTPS traffic over the management (MGT) interface.
Recommended For You
Recommended Videos
Recommended videos not found.