I was wondering if anyone has any experience using a totally airgapped panorama/firewalls deployment.
At the moment I have a case where none of the devices are allowed any outside connections.
I thought it would be do-able since both software and content updates can be manually uploaded to panorama and deployed like this, and license keys can be downloaded and uploaded to the firewalls... That should cover all bases, right?
Now we realize that panorama isn't aware of licenses manually uploaded to firewalls. The only way to make panorama aware of the licenses present on a firewall is by letting it connect to the outside license server (updates.paloaltonetworks.com I suppose...). Since we need a valid suppport license to be known on the Panorama to push software updates and content packs, the whole thing falls apart.
It doesn't make sense to me. They implemented ways to do version and content updates in an airgapped system, but you still need to break the airgap to allow panorama to retrieve the licenses for the airgap solutions to work.
I must be missing something, right?
You have to have some kind of access for Panorama to retreive updates. I run firewalls that have no internet access what-so-ever. But, they can reach Panorama which does have internet access (licences/software/updates/etc). This way, everything is managed exclusively from Panorama.
Are you wanting to run no internet access at all, even for Panorama? If so, I'd be curious why?
All I can say is... WOW! Sounds like a security analyst got a little over zealous. If you're air gapped and can't automate updates, what's the point of even running a PAN. Go get yourself some dumb L3/L4 firewall and call it a day. Sounds like a mess.
All I'm going to say about that is that even without automated updates, PAN still won.
But regardless how anyone feels about airgapping an PAN deployment, fact is that PAN supports it:
*activation via uploadable license keys on both panorama and firewalls
*uploadable software updates
*uploadable content updates
It's quite frustrating to find out you then need to open a connection to the palo alto update server after all, because the firewalls can't report their license status to panorama. At that point, everything you need is already present in the airgapped segment!
Not sure if you ever received an answer to this but I just found the following while doing this same research for another client:
"....To accomplish this, you must deploy an additional Panorama with internet access and an SCP server. After you deploy the Panorama with internet access, you configure the internet-connected Panorama to automatically download content updates to the SCP server. From the SCP server, the air-gapped Panorama is configured to automatically download and install dynamic updates as per your dynamic updates schedule."
Hope this helps others....
I have not tested this new feature yet but it seems it does not solve the license issue. Panorama just can't deploy a dynamic updates if it is not aware of the licenses of each device. And unfortunately this new feature works only with dynamic updates, not software updates.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!