topic Re: Anyone with exp in Firewall PAN-OS SD-WAN without panorama for VPN S2S Dual ISP ? in Next-Generation Firewall Discussions

Anyone with exp in Firewall PAN-OS SD-WAN without panorama for VPN S2S Dual ISP ?

Metgatz — Sun, 27 Apr 2025 20:30:46 GMT

Anyone with exp in PAN-OS SD-WAN without panorama for VPN S2S Dual ISP ?

Hi Live PAN-community, how's it going ?

Does anyone have operational functional experience of pan-os sdwan ( firewall sdwan without panorama and without cloudgenix appliances ) deployments operating and running sites with two ISPs for IPSEC S2S VPN connections.

Today we have operating only pan-os sdwan for internet outbound, with 2 unified links, operating well, however with limitations but it works and good well.

Now thinking of moving to VPN S2S using pan-os sdwan scheme, anyone has experience of deployment in their environments ? if it operates correctly ? Points, tips, points to focus on, recommendations, headaches, etc. If you have had any unexpected problems, what has been your feedback, your experience operating between HQ to VPN S2S branches of at least 5, 10 or more pan-os sites between your PANW firewalls of branches against the HQ.

Please only people with sdwan exp, from their pan-os licensed firewalls who have real experience without using Panorama, where the deployment is not the best, but it is valid, functional, operable with the important limitations, of course, but functional.

Thank you for your kindness, kindness, your time and collaboration

Best Regards

Re: Anyone with exp in Firewall PAN-OS SD-WAN without panorama for VPN S2S Dual ISP ?

Bitmasker — Wed, 30 Apr 2025 09:32:06 GMT

I'm also curious. The docs don't list it anywhere as a pre-requisite but Panorama is referenced multiple times for managing the VPN clusters in the admin guide and really nothing on the firewalls themselves.

This page for Auto VPN / mesh states:

Enable SD-WAN with Auto VPN

Where Can I Use This?

NGFW

What Do I Need?

SD-WAN license

Then literally the first line says: Auto VPN enables you to create SD-WAN cluster to connect multiple LANs using the Panorama management server.

Re: Anyone with exp in Firewall PAN-OS SD-WAN without panorama for VPN S2S Dual ISP ?

TomYoung — Wed, 30 Apr 2025 11:54:46 GMT

Hi @Bitmasker and @Metgatz ,

Panorama is required for PAN-OS SD-WAN. https://docs.paloaltonetworks.com/sd-wan/activation-and-onboarding/system-requirements-for-sd-wan

You could also use SCM. https://docs.paloaltonetworks.com/strata-cloud-manager/getting-started/manage-configuration-ngfw-and-prisma-access/network-policies/sd-wan-policies

Thanks,

Tom

Re: Anyone with exp in Firewall PAN-OS SD-WAN without panorama for VPN S2S Dual ISP ?

cardavis — Wed, 15 Oct 2025 20:51:47 GMT

What if I only want to use SDWAN for app-path routing for local DIA breakout only? Is panorama still a requirement?