Deploy NGFW-ZTNA Integration with Strata Cloud Manager

1. Verify that an NGFW license is activated on your Strata Cloud Manager tenant.

   Your tenant requires one of the following licenses: AIOps for NGFW, Strata Cloud ManagerPro, or an equivalent NGFW SKU. To confirm the license is active, navigate to the NGFWsection in Strata Cloud Manager, if All Firewalls is visible, the license is activated.
2. Register your NGFW with the Strata Cloud Manager tenant and move it to cloud management.

   1. Ensure your NGFW has a valid Device Certificate from the Palo Alto Networks support portal.
   2. In the Palo Alto Networks Hub, go to Device Associations, select Add Device, and associate your NGFW by serial number with your tenant.
      Once associated, the device appears under Available Devices in Strata Cloud Manager.
   3. In Strata Cloud Manager, select SettingsDevice ManagementAvailable Devices, Select your NGFW and choose Move to Cloud Management.
3. On the NGFW, set the management mode to Cloud Service and commit the changes. Verify that the cloud management status on the NGFW shows Connected before proceeding.
4. Verify that the NGFW is using default routing mode.

   Advanced routing isn't supported for NGFW Connector. In Strata Cloud Manager, select theselect the NGFW's Virtual Router, if the router shows Legacy, default routing is active. If it shows Advanced, disable advanced routing on the NGFW and reboot it before proceeding.
5. In Strata Cloud Manager, create a folder for your NGFW devices and add your device to it.

   1. Go to System SettingsFolder ManagementAdd Folder.
   2. Add a Name, Description, Labels, and select which firewalls you want to associate. Select Create to create a folder, and move your NGFW device into it.
      Strata Cloud Manager uses snippets to group NGFW Connector-related configurations separately from your existing folder configuration. Snippets are automatically created and attached to the folder when you onboard an NGFW Connector, you don't configure them directly.
6. Configure the WAN and local interface variables for your NGFW.

   1. At the folder level, assign the WAN interface variable to the appropriate physical interface (for example, ethernet1/1).
      Strata Cloud Manager uses object variables for interface assignment, you cannot assign aassigna physical interface directly. Default variables for WAN and local interfaces are available,or you can create custom variables.
   2. At the device level, set the specific values for each variable, including the WAN IP address and local interface IP address.
7. Configure a Virtual Router with a default route for internet connectivity.

   1. In Strata Cloud Manager, go to NetworkVirtual Routers and create a new Virtual Router or select an existing one.
   2. Add the WAN and local interfaces to the Virtual Router.
   3. Under Static Routes, add a default route through the WAN interface for internet connectivity.
8. Assign the WAN and local interfaces to security zones.

   In Strata Cloud Manager, go to Network > Zones. Default zones are available — assign the WAN interface to the internet or untrust zone and the local interface to the trust or local zone. You can also create new zones.
9. Commit and Push the network configuration to the NGFW.

   This commits the folder, interface, virtual router, and zone configuration from the preceding steps. Review the changes before committing to avoid unintended modifications to your environment. After you create the NGFW Connector in the next phase, Strata Cloud Manager automatically pushes the connector configuration to your NGFW.