>
    Strata Copilot
    Install the SD-WAN Plugin
    Focus
    Download PDF
    Focus
    1. Home
    2. SD-WAN
    3. Install the SD-WAN Plugin
    Download PDF
    SD-WAN

    Install the SD-WAN Plugin

    Table of Contents

    Install the SD-WAN Plugin

    Install the SD-WAN plugin on the Panorama™ management server.
    Where Can I Use This?What Do I Need?
    • NGFW
    A Panorama™ management server with an SD-WAN plugin is required to configure and manage an SD-WAN deployment.
    Panorama enables you to effectively configure, manage, and monitor your Palo Alto Networks firewalls with central oversight.
    The Panorama management server provides centralized monitoring and management of multiple Palo Alto Networks Next-Generation Firewalls. It provides a single location from which you can oversee all applications, users, and content traversing your network, and then use this knowledge to create application enablement policy rules that protect and control the network. Using Panorama for centralized policy and firewall management increases operational efficiency in managing and maintaining a distributed network of firewalls.
    (Versions earlier than SD-WAN 3.4.0) It is important that you have Panorama with compatible PAN-OS. Refer system requirements for SD-WAN to know the PAN-OS and SD-WAN compatible versions.
    (PAN-OS 12.1.2 and later versions, SD-WAN 3.4.0 and later versions) The Panorama plugin bundling in PAN-OS 12.1.2 addresses a critical operational challenge you face when upgrading Panorama versions. Previously, you needed to manually ensure compatibility between the PAN-OS version and the corresponding SD-WAN plugin version.
    Beginning with the PAN-OS 12.1.2, the SD-WAN plugin is bundled within the Panorama, ensuring that the SD-WAN plugin version is always compatible with your PAN-OS version. When you upgrade your Panorama management server, any SD-WAN plugin version you had previously installed and configured will automatically upgrade to the new compatible version while preserving all existing configurations and data. This seamless transition reduces the risk of configuration loss during upgrades.
    Additionally, Panorama automatically validates resource requirements before enabling SD-WAN plugin, preventing scenarios where plugin processes fail to start due to insufficient memory or system resources. The Panorama plugin bundle approach also enables you to receive plugin updates through regular maintenance releases, rather than requiring separate plugin installation procedures that could introduce compatibility issues or service disruptions.
    (Versions earlier than SD-WAN 3.4.0) All the branches and hub firewalls must be managed by a Panorama, where SD-WAN plugin will be installed.
    • When Panorama is connected to the internet, you can download and install the SD-WAN plugin directly from the Panorama web interface. The plugin needs to be installed only on the Panorama managing your SD-WAN firewalls, and not on the individual hub and branch firewalls.
    • When Panorama is not connected to the internet, you must download the SD-WAN plugin from the Palo Alto Networks Customer Support Portal and upload the plugin to Panorama. The plugin needs to be installed only on the Panorama managing your SD-WAN firewalls, and not on the individual hub and branch firewalls.

    Panorama is Internet-Connected

    Download the SD-WAN plugin in the Panorama® management server from the Plugins tab.
    1. Log in to the Panorama Web Interface.
    2. Select PanoramaPlugins, search for the sd_wan plugin and Check Now for the most recent version of the plugin.
    3. Download and Install the SD-WAN plugin.
    4. After you successfully install the SD-WAN plugin, select Commit and Commit to Panorama.
      This step is required before you can commit any configuration changes to Panorama.
    5. (Management Only mode only) Enable the logging disks required to store SD-WAN monitoring data.
      • M-Series Appliances—All M-Series appliances come with two pairs of 8TB logging disks in RAID 1 by default. When managing firewalls leveraging SD-WAN from Panorama in Management Only mode, you must enable the first pair of logging disk pairs to store SD-WAN monitoring data.
      1. Log in to the Panorama CLI.
      2. Enable the first pair of logging disk pairs included by default with your M-Series appliance.
        > request system raid add A1
      3. Verify that logging Logging Disk Pair A is Available:
        > show system raid detail
        When the RAID set up is complete, the following response displays:
        Disk Pair A       Available 
   Status         clean 
   Disk id A1     Present 
       model        : ST91000640NS 
       size         : 953869 MB 
       status       : active sync
      4. Make the logging disk pairs available for logging.
        1. Select PanoramaManaged Collectors and edit the Log Collector.
        2. Select Disks and Add each array.
        3. Click OK to save your changes.
        4. Select CommitCommit to Panorama and Commit your changes.
        5. Select CommitPush to Devices, select the Collector Group, and Push your changes.
      • Panorama Virtual Appliances—If you deployed your Panorama virtual appliance in Management Only mode, you must increase the system disk to 224GB to store SD-WAN monitoring data.
    6. Continue to set up Panorama and firewalls for SD-WAN to begin configuring your SD-WAN deployment.

    Panorama is Not Internet-Connected

    Download the SD-WAN plugin in the Panorama™ management server from the Palo Alto Networks Customer Support Portal.
    1. Log in to the Palo Alto Networks Customer Support Portal.
    2. Select UpdatesSoftware Updates, and in the Filter By drop-down select Panorama Integration Plug In.
    3. Locate and download the SD-WAN Plug-in.
    4. Log in to the Panorama Web Interface.
    5. Select PanoramaPlugins and Upload the SD-WAN plugin.
    6. Browse and locate the SD-WAN plugin you downloaded from the Customer Support Portal and click OK.
    7. Install the SD-WAN plugin.
    8. After you successfully install the SD-WAN plugin, select Commit and Commit to Panorama.
      This step is required before you can commit any configuration changes to Panorama.
    9. (Management Only mode only) Enable the logging disks required to store SD-WAN monitoring data.
      • M-Series Appliances—All M-Series appliances come with two pairs of 8TB logging disks in RAID 1 by default. When managing firewalls leveraging SD-WAN from Panorama in Management Only mode, you must enable the first pair of logging disk pairs to store SD-WAN monitoring data.
      1. Log in to the Panorama CLI.
      2. Enable the first pair of logging disk pairs included by default with your M-Series appliance.
        > request system raid add A1
      3. Verify that logging Logging Disk Pair A is Available:
        > show system raid detail
        When the RAID set up is complete, the following response displays:
        Disk Pair A       Available 
   Status         clean 
   Disk id A1     Present 
       model        : ST91000640NS 
       size         : 953869 MB 
       status       : active sync
      4. Make the logging disk pairs available for logging.
        1. Select PanoramaManaged Collectors and edit the Log Collector.
        2. Select Disks and Add each array.
        3. Click OK to save your changes.
        4. Select CommitCommit to Panorama and Commit your changes.
        5. Select CommitPush to Devices, select the Collector Group, and Push your changes.
      • Panorama Virtual Appliances—If you deployed your Panorama virtual appliance in Management Only mode, you must increase the system disk to 224GB to store SD-WAN monitoring data.
    10. Continue to set up Panorama and firewalls for SD-WAN to begin configuring your SD-WAN deployment.

    © 2026 Palo Alto Networks, Inc. All rights reserved.