topic Re: Convert traditional 820 firewall to ZTP in General Topics

Convert traditional 820 firewall to ZTP

smelias — Mon, 01 Nov 2021 18:50:28 GMT

Hi,

Is it possible to redeploy a pair of 820 firewalls and convert those firewalls to the ZTP model?

Re: Convert traditional 820 firewall to ZTP

TomYoung — Mon, 01 Nov 2021 19:35:44 GMT

I can't find anything. It looks like it is not supported -> https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/panorama-features/next-generation-firewalls-for-zero-touch-provisioning.html. However, the PA-400 Series support ZTP natively.

Thanks,

Tom

Re: Convert traditional 820 firewall to ZTP

OtakarKlier — Wed, 03 Nov 2021 21:27:56 GMT

Hello,

Please take a look and see if these articles will help answer your questions:

https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/set-up-zero-touch-provisioning/ztp-overview/about-ztp

Regards,

Re: Convert traditional 820 firewall to ZTP

smelias — Wed, 03 Nov 2021 22:20:58 GMT

Thanks however it doesn't mention converting a traditional 820 into a 820-ZTP model.

Can't we reimage a 820 into an 820-ZTP?

Re: Convert traditional 820 firewall to ZTP

TomYoung — Wed, 03 Nov 2021 23:17:16 GMT

Hi @smelias ,

Not through any public documentation that I can find. That is why I said that I don't think it is supported.

Thanks,

Tom

Re: Convert traditional 820 firewall to ZTP

LAYER_8 — Fri, 05 Nov 2021 15:33:58 GMT

Hi Team.

ZTP firewalls have a slightly different physical architecture than other devices. For example, you can't deploy an 820 ZTP and 820 in an HA pair, even if they have the same licenses. Without digging into proprietary info, you won't be able to reimage a non ZTP 820 into one. That will be a separate appliance.

Re: Convert traditional 820 firewall to ZTP

OwenFuller — Tue, 09 Nov 2021 14:49:41 GMT

Sorry, I deleted my last comment, as I thought you were trying to turn a ZTP firewall into a non-ZTP firewall. As I understand it, there is a separate physical chip (or chips) on the ZTP firewalls that is not present on non-ZTP models. ZTP models also have a claim code listed on them, which is needed to activate them w/ the ZTP service. The ZTP service at Palo Alto is expecting to match the serial/cliam key w/ a hash in a database when it connects. There isn't a way to make a non-ZTP device use ZTP.