Hi!
Here is my notes about HA pair FW`s adding to Panorama.
Follow these steps it will be work.
Adding HA Fw`s to Panorama.
- Connect firewalls to the Panorama:
Panorama:
a. Panorama -> Managed Devices -> Summary -> Add
Enter device S/N. Enable Associate Devices checkbox. Generate Auth Key and copy it.
b. Commit to Panorama.
Firewall:
a. Device -> Setup -> Panorama Settings
Write the IP addresses of the Panorama SRVs. Paste created before Auth Key.
b. Commit.
- Check connected device status in Panorama:
Panorama -> Managed Devices -> Summary (the status should be connected)
- Disable config sync in firewalls:
Device -> HA -> General -> Setup
Commit
- Import firewall config to Panorama:
Panorama -> Setup -> Operations -> Import device configuration to Panorama
(The same steps for both firewalls)
Commit to Panorama
- Leave just 1 Template Stack for HA devices:
Panorama -> Templates
- Remove HA config from each template:
Device -> HA -> Template -> Remove all
(The same steps for both firwalls)
Commit to Panorama
- Export or push device config bundle:
Panorama -> Setup -> Operations -> Export or push device config bundle
(The same steps for both firewalls)
Commit -> Push to device
- Leave just 1 Device Group for HA devices:
Panorama -> Managed Devices -> Summary
Commit and Push
- Enable config sync on firewalls:
Device -> HA -> General -> Setup
Commit
- Plan the transition to Panorama Mgmt
- Disable config sync
- Add HA Firewalls to Panorama
- Verify that the device state for each firewall is connected
- Import each Firewall config into Panorama
- Add the HA firewall pair into the same device group and template stack
- Push the device group and template stack configuration changes to your managed firewalls
- Enable config sync
-----------------------------------------------
Migrate a Firewall HA Pair to Panorama Management and Reuse Existing Configuration
- Disable configuration synchronization between the HA peers on each peer.
- Add HA firewalls to Panorama mgmt.:
a. Create a device registration auth key
Panorama -> Device Registration Auth Key and Add a new auth key
Copy Auth key and close.
b. Add firewalls to a Panorama mgmt. server.
Select Panorama -> Managed Devices -> Summary and Add a new firewall.
Enter the firewall SN
(No Need) Select Associate Devices to associate the fw with a device group.
Enter the device registration auth key created before.
Click ok.
c. (No Need) Associate firewall with a device group.
DISABLE Auto Push on 1st connect
Click OK to add device.
d. Configura the fw to communicate with Panorama.
Login to the fw.
Configure the Panorama setings.
Device -> Setup -> Management and edi Panorama settings.
Enter primary and secondary Panorama addresses and Auth key.
Click OK and commit your changes.
e. Auth using custom cert???
f. Commit to Panorama and commit your changes.
g. Verify that the firewalls is connected to Panorama.
Panorama -> Managed Devices -> Summary.
Device state should be shown as “Connected”.
- Import each firewall config into Panorama.
a. Panorama -> Setup -> Operations and click Import device configuration to Panorama and select the device.
b. Edit template name.
c. Commit to Panorama.
d. Panorama -> Setup -> Operations and Export or push device config bundle. Select the device, select ok and Push & Commit the configuration.
e. Launch the Web Interface of the firewall HA peer and ensure that the configuration pushed in the previous step committed successfully. If not, Commit the changes locally on the firewall.
f. Repeat Step 1-6 above on the second firewall. The process creates a device group and template stack per each firewall.
Best regards!
Rashadat Seyidzada
Azerbaijan, Baku
