Enable SCP Uploads for an Administrator

Table of Contents

Configure SAML Authentication for Panorama Administrators

Configure Tracking of Administrator Activity

Enable SCP Uploads for an Administrator

Enable Secure Protocol Copy (SCP) uploads for a Panorama™ management server Superuser administrator.

Where Can I Use This?	What Do I Need?
NGFW (Managed by Panorama)	Panorama superuser role

Enable Use Secure Copy Protocol (SCP) for Superuser administrators on your Panorama™ management server to upload supported files, such as PAN-OS software updates, dynamic content updates, and configuration file import from a local device to Panorama. This allows you to automate supported file uploads using CLI rather than uploading using the Panorama web interface.

A system log is generated when you successfully SCP to Panorama or if an SCP upload fails for any reason.

Palo Alto Networks support SCP uploads of PAN-OS software versions, PAN-OS software changes, dynamic content updates, PAN-OS plugin versions, configuration files, and license key files.

SCP uploads to Panorama of software updates and dynamic content updates for managed firewalls are not supported. You must enable SCP uploads locally for each individual firewall to upload a software update or dynamic content updates.

(Optional) Configure a Panorama administrator with Superuser privileges for SCP functionality.

In this example, we created a Superuser Panorama administrator named scp_admin.
Log in to the Panorama CLI.
Enable SCP functionality for a Superuser admin.

The admin initiating SCP must have Superuser privileges.

In this example, SCP functionality is enabled for the dedicated Superuser scp_admin created in the previous step.
1. Enter configuration mode.
  admin>configure
2. Enable SCP functionality for a Superuser admin.
  admin#set mgt-config users <admin_name> preferences enable-scp-server yes
3. Verify that SCP functionality was successfully enabled for the Superuser admin.
  admin#show mgt-config users <admin_name>
  
  In the permissions, verify that enable-scp-server displays yes.
4. Commit.
  admin# commit
Perform an SCP upload to Panorama.
To upload a file to Panorama using SCP, the local device you are uploading from and Panorama must be on the same subnet. This step assumes you already have the file you want to upload to Panorama available on your local device.

This example demonstrates how to upload an Application & Threats content update to Panorama. The predefined target directories for SCP uploads are:
- PAN-OS Software Versions—/scp/software/
- PAN-OS Software Patches—/scp/patch/
- Application & Threats Content Updates—/scp/content/
- WildFire Content Updates—/scp/wildfire/
- Antivirus Content Updates—/scp/anti-virus/
- PAN-OS Plugin Versions—/scp/plugin/
- XML Configuration Files—/scp/config/
  
  All PAN-OS config files must have the .xml extension appended to the file name for SCP uploads to succeed.
- License Key Files—/scp/license/
1. Open a CLI terminal and use the cd command to navigate to the folder or directory where the file you want to SCP is located.
  
  After navigating to the correct folder or directory, enter ls to view folder or directory contents.
  
  In this example, you can see the panupv2-all-contents-8765-8342 file we will upload to Panorama.
2. Upload a file to Panorama using the SCP-enabled Superuser admin.
  SCP applications like WinSCP and FileZilla are not supported. The SCP command must be run from the device command line.
  
  Operating System running OpenSSH 8 or earlier
  scp <file_name> <scp_superuser>@<panorama_IP>:/scp/<file_type>/<file_name>
  
  Example of the SCP command to upload the Application & Threats content update using the scp_admin.
  scp panupv2-all-contents-8765-8342 scp_admin@<panorama_IP>:/scp/content/panupv2-all-contents-8765-8342
  Operating System running OpenSSH 9 or later
  scp -o <file_name> <scp_superuser>@<panorama_IP>:/scp/<file_type>/<file_name>
  
  Example of the SCP command to upload the Application & Threats content update using the scp_admin.
  scp -o panupv2-all-contents-8765-8342 scp_admin@<panorama_IP>:/scp/content/panupv2-all-contents-8765-8342
3. Enter yes when prompted to verify Panorama authenticity.
  
  You are not prompted to verify authenticity if you have already connected to Panorama using SSH from this device and can skip this step.
4. Enter the SCP admin Password when prompted and click Enter to continue.
5. The SCP upload progress is displayed.
  
  The SCP upload is complete when the progress status displays 100% and the CLI command prompt is becomes available.
Verify the SCP upload.

You can verify that the SCP upload was successful by reviewing the generated system log and confirm that the uploaded file is available. In this example, we review the system log for the SCP upload of Application & Threats content update version 8765-8342.
1. Log in to the Panorama Web Interface.
2. Select MonitorSystem and filter for SCP uploads.
  ( description contains 'SCP' )
3. Select PanoramaDynamic Updates and confirm the uploaded content version is available to Download.