Register Panorama with the ZTP Service for Existing Deployments

1. Install the Panorama Device Certificate.
2. Log in to the Palo Alto Networks Customer Support Portal (CSP).
3. Associate your Panorama with the ZTP Service on the Palo Alto Networks CSP.

   The ZTP Service supports associating up to two Panoramas only if they are in a high availability (HA) configuration. If Panorama isn’t in an HA configuration, only a single Panorama can be associated.

   1. Select AssetsZTP Service and Modify Association.
   2. Select the serial number of the Panorama managing your ZTP firewalls.
   3. (HA only) Select the serial number of the Panorama HA peer.
   4. Click OK.
4. Log in to the Panorama web interface.
5. (ZTP over cellular only) Configure a DNS proxy object.

   (ZTP over cellular only) Onboarding a firewall over a cellular interface to Panorama fails if:

   • You require a cellular APN configuration to connect to your cellular network. It must be a public APN and a dynamic IP address. ZTP onboarding over cellular does not support a private APN or an APN with a static IP address.
   • ZTP firewall experiences poor signal strength or connectivity issues.

   1. Select NetworkDNS Proxy and add a new DNS proxy object.
   2. For the Location, select Shared.
   3. For the Inheritance Source, select ethernet 1/1.
   4. For the Secondary Inheritance Source, select cellular 1/1.
   5. For the Primary and Secondary DNS servers to which the NGFW sends DNS queries, select inherited.
   6. Click OK.
6. Select PanoramaZero Touch ProvisioningSetup and edit the General ZTP settings.
7. Register Panorama with the ZTP service.

   1. Enable ZTP Service.
   2. Enter the Panorama FQDN or IP Address.

      This is the FQDN or public IP address of the Panorama the ZTP plugin is installed on and that the CSP pushes to the ZTP firewalls.

      (Managed firewalls running PAN-OS 10.1.4 and earlier releases) Enter the Panorama IP address to avoid the managed firewall disconnecting from Panorama on reboot or after a successful PAN-OS upgrade.

      If you need to use the Panorama FQDN, configure a static destination route to avoid the managed firewall disconnecting from Panorama on reboot or after a successful PAN-OS upgrade.
   3. (HA only) Enter the Peer FQDN or IP Address.

      This is the FQDN or public IP address of the Panorama peer on which the ZTP plugin is installed and that the CSP pushes to the ZTP firewalls in case of failover.

      (Managed firewalls running PAN-OS 10.1.4 and earlier releases) Enter the Panorama IP address to avoid the managed firewall disconnecting from Panorama on reboot or after a successful PAN-OS upgrade.

      If you need to use the Panorama FQDN, configure a static destination route to avoid the managed firewall disconnecting from Panorama on reboot or after a successful PAN-OS upgrade.
   4. Click OK to save your configuration changes.

8. Create a new template stack and add the template generated in the previous step.

   1. Select Templates and Add a new template stack.
   2. Enter a descriptive Name for the template stack.
   3. (PAN-OS 11.2 and later releases) Check (enable) Automatically push content when software device registers to Panorama.
   4. In the Templates, add the template generated in the previous step.
9. (Recommended for PAN-OS 11.2 and later releases) Download the latest dynamic content versions to automatically install them your ZTP firewall when it successfully connects to Panorama for the first time.

   1. Select PanoramaDevice DeploymentDynamic Updates and Check Now.
   2. Download the latest dynamic content versions you want to install on your ZTP firewall.
10. Modify the ZTP device group, templates, and template stack as needed.

    Moving a ZTP firewall to a different device group or template stack isn’t supported. You must keep the ZTP firewalls in the ZTP device group and the template stack that includes the ZTP template generated by the ZTP plugin in the previous step. This is required for the firewall to maintain connectivity with Panorama and prevent any unintended configuration reverts on the firewall.

    When considering your device group hierarchy and template priority in your template stack, ensure that the device group and template containing the required ZTP configuration that allows the ZTP firewall and Panorama to communicate have priority such that the configuration isn’t overridden in the event of conflicting configurations.

    If modifying the ZTP device group and template used to onboard the ZTP firewall, be careful to not modify any of the ZTP configuration that was automatically populated when you created the device group and template in the previous step. This includes configurations like the Panorama IP address, virtual router, the ethernet1/1 interface, Security zone of the ethernet1/1 interface, the loopback.900 loopback interface, the rule1 Security policy rule, ztp-nat NAT policy rule, and the service route. These configurations are required to connect your ZTP firewall to Panorama and can lead to connectivity issues if modified.
11. Select Commit and Commit to Panorama
12. Sync to ZTP Service and verify that the Panorama Sync Status displays as In Sync.

13. Add a ZTP Firewall to Panorama.