We would be needing suggestion on the below scenario:
We are having an new Palo-Alto firewall connected via management console in our data center which is integrated with Panorama and we have pre-configured the box by pushing the templates available in panorama. Now we are moving the box to the location and mounting it and planning to perform initial configurations by connecting the firewall to the actual network. Our client suggested to upload the DAy-1 configuration file to the palo-Alto firewall while assigning the mgmt IP to the firewall.
1. Is the above condition will works ? If yes, will both our pre-configured configurations and Day-1 configuration will be present in our firewall ?
2. will the day-1 configurations will be local to firewall and if yes, is there any way to manage it via Panorama.
day1 is intended to be the very first config you put on a device so you have a good baseline of preconfigured security profiles and security settings.
a good way to integrate it into panorama would be to import it and set it as a shared template / shared device group objects so it can permeate into your other firewalls
your use case will be somewhat difficult as you already have a config in panorama which will overwrite or ignore the (local) day1 config. if you want to use day1, it is best to also import that into panorama and merge both configurations
Hi @Sujanya ,
@reaper is correct that ideally the Day 1 Configuration is for Day 1, but it is good to try to add them later rather than never.
If you load the Day 1 Configuration on the NGFW and then add it to the appropriate device group and template stack in Panorama:
To manage the Day 1 Config from Panorama, you have a few of options.
Try the commands below at your own risk to see if it adds the Panorama Day 1 Configuration device group and template to your Panorama candidate configuration.
load config partial mode merge from-xpath /config/devices/entry[@name='localhost.localdomain']/device-group/entry[@name='sample_devicegroup'] to-xpath /config/devices/entry[@name='localhost.localdomain']/device-group from <day1filename>
load config partial mode merge from-xpath /config/devices/entry[@name='localhost.localdomain']/template/entry[@name='iron-skillet'] to-xpath /config/devices/entry[@name='localhost.localdomain']/template from <day1filename>
Edit: With regard to Panorama, loading the Day 1 Configuration for a new Panorama build is ideal. It also includes modifications to the "shared" device group and items under the Panorama tab in addition to the device group and templates referenced above.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!