Register Panorama with the ZTP Service for New Deployments

1. Install the Panorama Device Certificate.
2. Log in to the Palo Alto Networks Customer Support Portal (CSP).
3. Associate your Panorama with the ZTP Service on the Palo Alto Networks CSP.

   The ZTP Service supports associating up to two Panoramas only if they are in a high availability (HA) configuration. If Panorama is not in an HA configuration, only a single Panorama can be associated.

   1. Select AssetsZTP Service and Associate Panorama(s).
   2. Select the serial number of the Panorama managing your ZTP firewalls.
   3. (HA only) Select the serial number of the Panorama HA peer.
   4. Click OK.
4. Log in to the Panorama web interface
5. (ZTP over cellular only) Configure a DNS proxy object.

   (ZTP over cellular only) Onboarding a firewall over a cellular interface to Panorama fails if:

   • You require a cellular APN configuration to connect to your cellular network. It must be a public APN and a dynamic IP address. ZTP onboarding over cellular does not support a private APN or an APN with a static IP address.
   • ZTP firewall experiences poor signal strength or connectivity issues.

   1. Select NetworkDNS Proxy and add a new DNS proxy object.
   2. For the Location, select Shared.
   3. For the Inheritance Source, select ethernet 1/1.
   4. For the Secondary Inheritance Source, select cellular 1/1.

      Review how to configure 5G for a cellular interface for more information.
   5. For the Primary and Secondary DNS servers to which the NGFW sends DNS queries, select inherited.
   6. Click OK.
6. Select PanoramaZero Touch ProvisioningSetup and edit the General ZTP settings.
7. Register Panorama with the ZTP service.

   1. Enable ZTP Service.
   2. Enter the Panorama FQDN or IP Address.

      This is the FQDN or public IP address of the Panorama the ZTP plugin is installed on and that the CSP pushes to the ZTP firewalls.

      (Managed firewalls running PAN-OS 10.1.4 and earlier releases) Enter the Panorama IP address to avoid the managed firewall disconnecting from Panorama on reboot or after a successful PAN-OS upgrade.

      If you need to use the Panorama FQDN, configure a static destination route to avoid the managed firewall disconnecting from Panorama on reboot or after a successful PAN-OS upgrade.
   3. (HA only) Enter the Peer FQDN or IP Address.

      This is the FQDN or public IP address of the Panorama peer on which the ZTP plugin is installed and that the CSP pushes to the ZTP firewalls in case of failover.

      (Managed firewalls running PAN-OS 10.1.4 and earlier releases) Enter the Panorama IP address to avoid the managed firewall disconnecting from Panorama on reboot or after a successful PAN-OS upgrade.

      If you need to use the Panorama FQDN, configure a static destination route to avoid the managed firewall disconnecting from Panorama on reboot or after a successful PAN-OS upgrade.
   4. Click OK to save your configuration changes.

8. Create the default device group and template to automatically generate the required configuration to connect your ZTP firewalls to Panorama.

   Adding the device group and template automatically generates a new device group and template that contain the default configuration to connect the Panorama and the ZTP firewalls.

   Palo Alto Networks recommends giving the ZTP device group and template a descriptive name that makes their purpose clear. Unintentionally modifying the default ZTP configuration results in connectivity issues if you want to reuse the device group and template to onboard new ZTP firewalls in the future.

   1. Add Device Group and Template.
   2. Enter the Device Group name.
   3. Enter the Template name.
   4. (PAN-OS 12.1 and later releases) Select the Interface Type used to communicate with the ZTP cloud service.

      • Ethernet 1/1—Standard interface used for communication between the NGFW and ZTP cloud service. Template stack generated by the ZTP plugin only configures the Ethernet 1/1 interface.
      • Cellular 1/1—Dedicated cellular interface for communication between the NGFW and ZTP cloud service over a 5G cellular connection. Template stack generated by the ZTP plugin only configures the Cellular 1/1 interface.
      • Ethernet 1/1 and Cellular 1/1—Allows the NGFW to communicate with the ZTP cloud service over a standard wired connection using the Ethernet 1/1 interface or over a 5G cellular connection over the Cellular 1/1 interface. Template stack generated by the ZTP plugin configures both the Ethernet 1/1 and Cellular 1/1 interfaces.
   5. Click OK to save your configuration changes.

9. Create a new template stack and add the template generated in the previous step.

   1. Select Templates and Add a new template stack.
   2. Enter a descriptive Name for the template stack.
   3. (PAN-OS 11.2 and later releases) Check (enable) Automatically push content when software device registers to Panorama.
   4. In the Templates, add the template generated in the previous step.
10. (Recommended for PAN-OS 11.2 and later releases) Download the latest dynamic content versions to automatically install them your ZTP firewall when it successfully connects to Panorama for the first time.

    1. Select PanoramaDevice DeploymentDynamic Updates and Check Now.
    2. Download the latest dynamic content versions you want to install on your ZTP firewall.
11. Modify the ZTP device group, templates, and template stack as needed.

    Moving a ZTP firewall to a different device group or template stack isn’t supported. You must keep the ZTP firewalls in the ZTP device group and the template stack that includes the ZTP template generated by the ZTP plugin in the previous step. This is required for the firewall to maintain connectivity with Panorama and prevent any unintended configuration reverts on the firewall.

    When considering your device group hierarchy and template priority in your template stack, ensure that the device group and template containing the required ZTP configuration that allows the ZTP firewall and Panorama to communicate have priority such that the configuration isn’t overridden in the event of conflicting configurations.

    If modifying the ZTP device group and template used to onboard the ZTP firewall, be careful to not modify any of the ZTP configuration that was automatically populated when you created the device group and template in the previous step. This includes configurations like the Panorama IP address, virtual router, the ethernet1/1 interface, Security zone of the ethernet1/1 interface, the loopback.900 loopback interface, the rule1 Security policy rule, ztp-nat NAT policy rule, and the service route. These configurations are required to connect your ZTP firewall to Panorama and can lead to connectivity issues if modified.
12. Select Commit and Commit to Panorama
13. Sync to ZTP Service and verify that the Panorama Sync Status displays as In Sync.

14. Add a ZTP Firewall to Panorama.