Using PANORAMA for an MSP

[Schneur_Feldman]

Would anyone know if its possible to use Panorama in an MSP environment to manage clients Palo Alto Firewalls?

For example, setup an Azure Panorama and use that to Manage all of our clients Firewalls from that Panorama? Like clients part of different businesses/organizations.

If yes, any ideas or documentation that can help?

[JayGolf]

Hi @Schneur_Feldman ,

I have not seen what you ask of, but I believe it would be possible to manage client firewalls as long as their networks are reachable.

I will ask around to see if I can provide more guidance.

[BPry · Accepted solution]

@Schneur_Feldman,

This will work perfectly fine from a technical level, and I've helped a few people implement it where the MSP provided all of the services for the companies in question as a fully managed service. In the event that you have someone local who needs to access the device and wants to make changes, that's where this starts to falter a bit.

Just a couple things to think about:

• How much are you basing your desire for Panorama on templating and not just centralized logging?
• If you just want centralized logging, is Panorama the actual most cost effective solution?
• How will the business recover the costs of Panorama? If you eat the costs for ease of management as part of a larger deployment that makes sense, but if you try to pass that along to the customer does your cost structure make that a customer benefit? (IE: Why should they pay you to make your life easier if there's practically no benefit for them).

[Schneur_Feldman]

Thanks everyone! Love the insight, so what would be the best Palo Solution for centralized logging for multiple MSP clients?

My experience is that MSP's that have tons of Palo clients, all the firewalls are just managed locally so nobody ever knows if there are alerts that need attention. Just wondering if Palo has any solutions for this.