Process to Rebuild Panorama with Prisma Access & Prisma SDWAN

[shawnmuas]

Posting here while waiting for TAC. We use Panorama to manage NGFW and Prisma Access with Prisma SDWAN integration.

We recently rebuilt Panorama Azure VM. Latest dynamic updates and plugins are installed, device cert is valid, and cloud services OTP applied.  We tried loading the old Panorama running config to get everything back to normal. However, after loading the config, we get commit errors related to Prisma Access config. Is there a specific process when restoring a backup config for Panorama that is also used to manage cloud services? Or, is it as simple as loading the config and performing the initial commit?

I'm wondering if we should load the backup config with our firewall device groups and templates, exclude the remote networks groups and templates, perform the initial commit, then focus on loading the remote networks/cloud services portion.

Any help appreciated. Thank you.

[shawnmuas · Accepted solution]

This happened to be a combination of Palo backend and user-induced errors. I was using a running config from a recent TSF, which apparently doesn't contain PSKs for IPSec tunnels, certs, and whatnot. Using an older manually generated Panorama config snapshot, we resolved a lot of the initial commit errors. We still needed to work with TAC to fix the Prisma Access integration that was an old-code/back-end issue but everything else after that was manageable from our perspective. For future reference, rebuilding a Panorama Azure VM managing Prisma Access involves the following high-level steps:

• Spin up new Panorama VM from Azure marketplace.
• Once Panorama is accessible, define DNS and NTP, get latest dynamic updates, plugins, and downgrade Panorama software back to your preferred version if needed.
• Make sure OTP is set up for Panorama AND Cloud Services. There is an OTP process for each.
• Import the latest manually configured Panorama snapshot that you have, then load.
• Commit to Panorama and if you don't see any major errors, you're making progress. That initial commit has to work or you're dead in the water.
• If using Prisma SDWAN integration with Prisma Access, you may have to regenerate and/or reapply the PSK in Panorama. This has to match the PSK configured in Prisma SDWAN.
• At this point, fix any local overrides since Panorama went down, sync them to Panorama however you wish, and get back to work.
• Good luck!