Licenses on Airgapped Panorama

[TSchepers]

Hi guys,

I was wondering if anyone has any experience using a totally airgapped panorama/firewalls deployment.
At the moment I have a case where none of the devices are allowed any outside connections.

I thought it would be do-able since both software and content updates can be manually uploaded to panorama and deployed like this, and license keys can be downloaded and uploaded to the firewalls... That should cover all bases, right?

Now we realize that panorama isn't aware of licenses manually uploaded to firewalls. The only way to make panorama aware of the licenses present on a firewall is by letting it connect to the outside license server (updates.paloaltonetworks.com I suppose...). Since we need a valid suppport license to be known on the Panorama to push software updates and content packs, the whole thing falls apart.

It doesn't make sense to me. They implemented ways to do version and content updates in an airgapped system, but you still need to break the airgap to allow panorama to retrieve the licenses for the airgap solutions to work.

I must be missing something, right?

[jeremy.larsen]

You have to have some kind of access for Panorama to retreive updates.  I run firewalls that have no internet access what-so-ever.  But, they can reach Panorama which does have internet access (licences/software/updates/etc).  This way, everything is managed exclusively from Panorama.

Are you wanting to run no internet access at all, even for Panorama?  If so, I'd be curious why?

[TSchepers]

Indeed, no Internet access whatsoever is the goal. It's required by a customer. Both firewalls and panorama are deployed in airgapped scada network segments that can't have any connections to the outside.

At the moment it seems like the only time we'd need an outside connection is when panorama retrieves license information. Updates can be uploaded to the airgapped network. This makes no sense, since there is a license key system in place for both firewall locally, but no way for the firewall to relay this information to the panorama, and no way to import the firewall's license key on panorama. But the fact that we can activate panorama using license keys and upload OS versions and content updates seems to point to support for a fully airgapped panorama.
So close...

[jeremy.larsen]

All I can say is... WOW!  Sounds like a security analyst got a little over zealous.  If you're air gapped and can't automate updates, what's the point of even running a PAN.  Go get yourself some dumb L3/L4 firewall and call it a day.  Sounds like a mess.

[TSchepers]

All I'm going to say about that is that even without automated updates, PAN still won.

But regardless how anyone feels about airgapping an PAN deployment, fact is that PAN supports it:

*activation via uploadable license keys on both panorama and firewalls

*uploadable software updates

*uploadable content updates

It's quite frustrating to find out you then need to open a connection to the palo alto update server after all, because the firewalls can't report their license status to panorama.  At that point, everything you need is already present in the airgapped segment!

[LHenshaw]

Hi there,

Not sure if you ever received an answer to this but I just found the following while doing this same research for another client:

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-new-features/panorama-features/automatic-conten...

"....To accomplish this, you must deploy an additional Panorama with internet access and an SCP server. After you deploy the Panorama with internet access, you configure the internet-connected Panorama to automatically download content updates to the SCP server. From the SCP server, the air-gapped Panorama is configured to automatically download and install dynamic updates as per your dynamic updates schedule."

Hope this helps others....

[xdauphin]

I have not tested this new feature yet but it seems it does not solve the license issue. Panorama just can't deploy a dynamic updates if it is not aware of the licenses of each device. And unfortunately this new feature works only with dynamic updates, not software updates.