How to onboard palo in to panorama

[rbabu0]

Hi Team,

Our palo already onboarded in to the panorama. Due to some reason our L3 team disabled panorama setting in the palo. Now we need to re-add in to the panorama. Please tell me how need to do?

1. Palo we need to enable pano setting only enough 

2. or we need to import the config in the panorama as well ?

[PavelK]

Thank you for the post @rbabu0

in nutshell, unless Firewall's related setting (serial number registration, assignment to DG/TS, log collector assignment) has been deleted from Panorama side, all you have to is to make sure that Firewall is configured with Panorama's IP address and all the required ports are enabled between Firewall and Panorama, then all should work again. Below is detailed break down: 

In order to re-enable Firewall to be registered and managed by Panorama make sure that below settings are in place on Firewall side:

- Navigate to Device > Setup > Management > Panorama Settings > Edit > Panorama Servers. Make sure that Firewall has configured IP address of Panorama (Secondary IP address is used only in the case you have Panorama in HA).

- Make sure that Firewall can reach Panorama IP address. By default management interface will be used for registration to Panorama.

- If your L3 Team has used the feature: "Disable Panorama Policy and Objects" & "Disable Device and Network Template", then refer to this KB for recovery: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClffCAC

On Panorama side, make sure that below configuration is in place:

- Panorama registers Firewall with Firewall's serial number. Since you mentioned that it was previously registered, likely you do not have to do anything unless somebody has completely deleted the Firewall from Panorama. Make sure that Device State under: Panorama > Managed Devices > Summary is reporting status: "Connected".

- If you have to onboard Firewall to Panorama from scratch, please refer to this documentation for PAN-OS 9.1: https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/add-a-firewall-as-a-m...

For PAN-OS 10.1 and higher refer to this document: https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/add-a-firewall-as-a-... The only difference between these 2 versions is the step to add authentication key.

- Make sure that Firewall is added to Device Group and Template Stack for configuration pushing and log collector group for log collection.

Kind Regards

Pavel