topic Re: Best Way For Configuration of 5 PA-200 Before Shipping To Remote Location in General Topics

Best Way For Configuration of 5 PA-200 Before Shipping To Remote Location

Doug_Hogue — Fri, 22 Jul 2016 19:14:23 GMT

The next big project, regarding Palo Alto, is deploying a total of 5 PA-200’s. 4 will be located in 3 different locations in Mexico. 1 Mexican location will have 2 PA-200’s setup in HA mode. The remaining PA-200 will be deployed in Managua, Nicaragua. They all will be configured with Wildfire, Threat Protection, URL Filtering and Global Protect. We of course want to manage these via Panorama.

I am reaching out to see if Palo Alto has a Best Practice document available explaining how to configure these boxes using Panorama and then ship to remote locations as close as possible to “plug and play”. I can find nothing that really covers configuring locally to send to remotes locations.

Re: Best Way For Configuration of 5 PA-200 Before Shipping To Remote Location

jambulo — Mon, 25 Jul 2016 18:56:48 GMT

We pretty much configure and push everything in the Policies, Objects and Device tab using Panorama. Then we manually configure the items in the Network tab, mostly because our remote sites aren't generally the same.

One thing I would suggest is to set up an emergency "back door" to the PA-200. Just in case it doesn't come online or the site-to-site tunnel(if you're using one) doesn't come up. You could give SSH or HTTPS access to the PA-200 and allow only your source IP. You could also ship a laptop(with client VPN) and a cellular hot spot with it, so you can remote into the PA-200(assuming a tech or someone can plug it in).