11.2 and Later

1. Log in to the Panorama web interface.
2. Add a ZTP firewall to Panorama. Select PanoramaZero Touch ProvisioningFirewall Registration.

   You must connect the ZTP firewall to the internet using the Eth1/1 interface or a supported cellular interface to successfully register the ZTP firewall with the CSP and push the policy and network configurations.

   1. Select Firewall Registration and Add a new ZTP firewall.
   2. Enter the Serial Number of the ZTP firewall.
   3. Enter the Claim Key for the ZTP firewall provided by Palo Alto Networks.

      Find the eight-digit numeric claim key on a physical label attached to the back of the ZTP firewall.

   4. Enter the Auth Code for the ZTP to activate licenses on the firewall after it successfully connects to Panorama for the first time.
   5. Click OK to save your configuration changes.

   6. Select the newly added ZTP firewall and Register the firewall.

      When prompted, click Yes to confirm registering the ZTP firewall.

3. Verify the firewall successfully registered with the CSP.

   The firewall must successfully register with the CSP to successfully obtain the device certificate.

   1. Select Registration Status and verify that the ZTP firewall successfully registered with the CSP.

   2. Log in to the Panorama web interface using admin credentials.
   3. Select PanoramaManaged DevicesSummary and verify that the ZTP firewall appears as a managed firewall.
4. Decide on the template and device groups to be used for the ZTP firewall.

   You cannot move a ZTP firewall to a different device group or template stack after ZTP onboarding. When considering your device group hierarchy and template priority in your template stack, ensure that the device group and template containing the required ZTP configuration that allows the ZTP firewall and Panorama to communicate have priority such that the configuration isn't overridden in the event of conflicting configurations.

   If you decide to use the Default ZTP Device Group and Template, complete the following steps:

   • Create the ZTP device group and template during initial Panorama setup. Select PanoramaZero Touch ProvisioningSetup and select Add Device Group and Template.
   • Associate this template with a template stack. Create a template stack under PanoramaTemplates or use an existing template stack.

   When you modify the ZTP device group and template, do not change any of the ZTP configuration that Panorama automatically populated when you created the device group and template. Changing these configurations can cause connectivity issues between your ZTP firewall and Panorama:

   • Panorama IP address
   • Virtual router
   • ethernet1/1 interface
   • Security zone of the ethernet1/1 interface
   • loopback.900 loopback interface
   • rule1 security policy rule
   • ztp-nat NAT policy rule
   • Service route

   If you decide to use non-ZTP device groups and templates, configure template and template stacks with the following steps:

   1. Select PanoramaTemplates.
   2. Configure the target templates and their respective template stacks that you plan to assign to the ZTP firewall. For more information, see Manage Templates and Template Stacks.
   3. Select NetworkInterfaces, and then from the Template drop-down select the target Template.
   4. Configure at least one interface, preferably ethernet1/1.
5. (Optional) To use eth0 for management operations, configure the Management Interface within the Template.

   1. Select DeviceSetupInterfaces.
   2. From the Template drop-down, select the target Template.
   3. Select the Management interface and configure a static IP or choose DHCP Client to configure an IP address on the interface. For more information on how to configure connection settings, see Device > Setup > Interfaces.

      Ensure that the interface has connectivity to Panorama.
   4. Perform a configuration push from Panorama to the ZTP firewall.
6. Add the ZTP firewall to the device group and template stack to be associated with the ZTP firewall.

   You must add the ZTP firewall to a device group and template stack for your firewalls to display as Connected to push policy and network configurations.

   You must keep the ZTP firewall in the ZTP device group and template stack associated with the ZTP template. This is required for the firewall to maintain connectivity with Panorama and prevent any unintended configuration reverts on the firewall.

   1. Log in to the Panorama web interface using admin credentials.
   2. Select PanoramaManaged DevicesSummary.
   3. Select the ZTP firewalls you added and registered in the previous step and Reassociate.
   4. Select the Device Group and Template Stack.
   5. Check (enable) Auto Push on 1st Connect to automatically push the device group and template stack configurations when the ZTP firewall successfully connects to Panorama for the first time.
   6. (Optional) Specify the To SW Version to automatically upgrade your firewalls to a more recent PAN-OS version.

      Ensure that the To SW Version column is configured to the correct PAN-OS version so that the firewall does not upgrade or downgrade unintentionally. ZTP functionality is supported only for PAN-OS 10.0.1 and later releases. Additionally, the PAN-OS version must be the same or an earlier version of the PAN-OS version running on Panorama.

      For more information, see Upgrade a ZTP Firewall.
   7. (Recommended for PAN-OS 11.2 and later releases) Download the latest dynamic content versions to automatically install them on your ZTP firewall when it successfully connects to Panorama for the first time.
   8. Commit and Commit to Panorama
7. Power on the ZTP firewall.

   Wait for the ZTP firewall to finish powering on. On Panorama, select PanoramaManaged DevicesSummary and verify that the ZTP firewall is now Connected.