Install the Panorama Device Certificate

Register Panorama with the Palo Alto Networks Customer Support Portal (CSP).

Configure the Network Time Protocol (NTP) server.

An NTP server is required validate the device certification expiration date, ensure the device certificate does not expire early or become invalid.

Log in to the Panorama Web Interface.
Select
Panorama
Setup
Services
.
Select
NTP
and enter the hostname
pool.ntp.org
as the
Primary NTP Server
or enter the IP address of your primary NTP server.
(
Optional
) Enter a
Secondary NTP Server
address.
(
Optional
) To authenticate time updates from the NTP server(s), for
Authentication Type
, select one of the following for each server.
None
(default)—Disables NTP authentication.
Symmetric Key
—Firewall uses symmetric key exchange (shared secrets) to authenticate time updates.
Key ID
—Enter the Key ID (1-65534)
Algorithm
—Select the algorithm to use in NTP authentication (
MDS
or
SHA1
)
Click
OK
to save your configuration changes.
Select
Commit
and
Commit to Panorama
.

Generate the One Time Password (OTP).

Log in to the Customer Support Portal.
Select
Assets
Device Certificates
and
Generate OTP
.
For the
Device Type
, select
Generate OTP for Panorama
and
Generate OTP
.
Select the
Panorama Device
serial number.
Generate OTP
and copy the OTP.

Log in to the Panorama Web Interface as an admin user.

Select

Panorama

Setup

Management

Device Certificate Settings

and

Get certificate

.



Enter the

One-time Password

you generated and click

OK

.

Panorama successfully retrieves and install the certificate.