Register Panorama with the ZTP Service for Existing Deployments
Register the Panorama™ management server with the ZTP
service for existing ZTP deployments.
After you install the ZTP plugin on the Panorama™
management server, you must register Panorama with the ZTP service
to enable the ZTP service to associate firewalls with the Panorama.
As part of the registration process, add your ZTP firewalls to a
device group and template that contain the required ZTP configuration
to connect your ZTP firewalls with the ZTP service after they first
connect to Panorama.
- Log in to the Palo Alto Networks Customer Support Portal (CSP).
- Associate your Panorama with the ZTP Service on the Palo Alto Networks CSP.The ZTP Service supports associating up to two Panoramas only if they are in a high availability (HA) configuration. If Panorama is not in an HA configuration, only a single Panorama can be associated.
- SelectandAssetsZTP ServiceModify Association.
- Select the serial number of the Panorama managing your ZTP firewalls.
- (HA only) Select the serial number of the Panorama HA peer.
- ClickOK.
- Selectand edit thePanoramaZero Touch ProvisioningSetupGeneralZTP settings.
- Register Panorama with the ZTP service.
- Enable ZTP Service.
- Enter thePanorama FQDN or IP Address.This is the FQDN or public IP address of the Panorama the ZTP plugin is installed on and that the CSP pushes to the ZTP firewalls.(All ZTP-enabled managed firewalls) Enter the Panorama IP address to avoid the managed firewall disconnecting from Panorama on reboot or after a successful PAN-OS upgrade.If you need to use the Panorama FQDN, configure a static destination route to avoid the managed firewall disconnecting from Panorama on reboot or after a successful PAN-OS upgrade.
- (HA only) Enter thePeer FQDN or IP Address.This is the FQDN or public IP address of the Panorama peer on which the ZTP plugin is installed and that the CSP pushes to the ZTP firewalls in case of failover.(All ZTP-enabled managed firewalls) Enter the Panorama IP address to avoid the managed firewall disconnecting from Panorama on reboot or after a successful PAN-OS upgrade.If you need to use the Panorama FQDN, configure a static destination route to avoid the managed firewall disconnecting from Panorama on reboot or after a successful PAN-OS upgrade.
- ClickOKto save your configuration changes.
- Add your ZTP firewalls to the device group and template that will contain the required ZTP configuration.
- Selectand select the device group that will contain the required ZTP configuration.PanoramaDevice Groups
- Select the ZTPDevices.
- ClickOKto save your configuration changes.
- Selectand select the template stack that contains the template that will have the required ZTP configuration.PanoramaTemplates
- Select the ZTPDevices.
- ClickOKto save your configuration changes.
- Modify your device groups and templates as needed.When considering your device group hierarchy and template priority in your template stack, ensure that the device group and template containing the required ZTP configuration that allows the ZTP firewall and Panorama to communicate have priority such that the configuration is not overridden in the event of conflicting configurations.
- Configure the Ethernet1/1 interface.
- Select, select aNetworkInterfacesEthernetTemplateto contain your ZTP configuration and selectethernet1/1.
- ForInterface Type, selectLayer3.
- SelectConfigand configure aVirtual Routerand set theSecurity ZonetoUntrust.
- SelectIPv4and for theType, selectDHCP Client.A DHCP client is required for the ZTP firewalls to communicate with the ZTP service.
- PressOKto save your configuration changes.
- Create the loopback interface
- Select, select aNetworkInterfacesLoopbackTemplateto contain your ZTP configuration andAdda loopback interface.
- For theInterface Name, enterloopbackand enter the900suffix.
- SelectConfig, select aVirtual Router, and set theSecurity ZonetoTrust.
- PressOKto save your configuration changes.
- Create the Security policy rule to allow the ZTP firewall and Panorama to communicate.
- Select, select thePoliciesSecurityPre RulesDevice Groupto contain your ZTP policy rules, andAdda new rule.
- Enter a descriptiveNamefor the policy rule.
- SelectandSourceSource ZoneAddtheTrustzone.
- SelectandDestinationDestination ZoneAddtheUntrustzone.
- Selectand selectActionAction SettingsActionAllow.
- Create the NAT policy rule to allow the ZTP firewall and Panorama to communicate.
- Select, select thePoliciesNATPre RulesDevice Groupto contain your ZTP policy rules, andAdda new rule.
- Enter a descriptiveNamefor the policy rule.
- SelectOriginal Packetand configure the following:
- For theSource Zone,AddtheTrustzone.
- For theDestination Zone, select theUntrustzone.
- For theDestination Interface, select theethernet1/1interface.
- ClickOKto save your configuration changes.
- SelectCommitandCommit to Panorama
- Sync to ZTP Serviceand verify that the Panorama Sync Status displays asIn Sync.
Recommended For You
Recommended Videos
Recommended videos not found.