How to onboard palo in to panorama

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

How to onboard palo in to panorama

L1 Bithead

Hi Team,

 

Our palo already onboarded in to the panorama. Due to some reason our L3 team disabled panorama setting in the palo. Now we need to re-add in to the panorama. Please tell me how need to do?

 

1. Palo we need to enable pano setting only enough 

2. or we need to import the config in the panorama as well ?

 

1 REPLY 1

Cyber Elite
Cyber Elite

Thank you for the post @rbabu0

 

in nutshell, unless Firewall's related setting (serial number registration, assignment to DG/TS, log collector assignment) has been deleted from Panorama side, all you have to is to make sure that Firewall is configured with Panorama's IP address and all the required ports are enabled between Firewall and Panorama, then all should work again. Below is detailed break down: 

 

In order to re-enable Firewall to be registered and managed by Panorama make sure that below settings are in place on Firewall side:

- Navigate to Device > Setup > Management > Panorama Settings > Edit > Panorama Servers. Make sure that Firewall has configured IP address of Panorama (Secondary IP address is used only in the case you have Panorama in HA).

- Make sure that Firewall can reach Panorama IP address. By default management interface will be used for registration to Panorama.

- If your L3 Team has used the feature: "Disable Panorama Policy and Objects" & "Disable Device and Network Template", then refer to this KB for recovery: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClffCAC

 

On Panorama side, make sure that below configuration is in place:

- Panorama registers Firewall with Firewall's serial number. Since you mentioned that it was previously registered, likely you do not have to do anything unless somebody has completely deleted the Firewall from Panorama. Make sure that Device State under: Panorama > Managed Devices > Summary is reporting status: "Connected".

- If you have to onboard Firewall to Panorama from scratch, please refer to this documentation for PAN-OS 9.1: https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/add-a-firewall-as-a-m...

For PAN-OS 10.1 and higher refer to this document: https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/manage-firewalls/add-a-firewall-as-a-... The only difference between these 2 versions is the step to add authentication key.

- Make sure that Firewall is added to Device Group and Template Stack for configuration pushing and log collector group for log collection.

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.
  • 1756 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!