#PALO ALTO PANORAMA HOW TO#

Group A, contains two log collectors and receives logs from three standalone firewalls. In the example above, device management function and reporting are performed on a VM Panorama appliance. For example: Device management may be performed from a VM Panorama, while the firewalls forward their logs to colocated dedicated log collectors:

The Panorama solution allows for flexibility in design by assigning these functions to different physical pieces of the management infrastructure. In addition to collecting logs from deployed firewalls, reports can be generated based on that log data whether it resides locally to the Panorama (e.g single M-series or VM appliance) for on a distributed logging infrastructure. Log Collection: This includes collecting logs from one or multiple firewalls, either to a single Panorama or to a distributed log collection infrastructure. A brief overview of these two main functions follow:ĭevice Management: This includes activities such as configuration management and deployment, deployment of PAN-OS and content updates. Since NCM can't currently read what's in the Binary tgz files that the Panorama's would generate, what traditional 'running' config backup should we be doing in addition to the binary backups so that we can take advantage of NCM's config change, inventory, policy auditing, and firmware vulnerabilities features as well?Ĭurrently we are already doing a 'show config running' on the firewalls, however the config file this generates is really small.The Panorama solution is comprised of two overall functions: Device Management and Log Collection/Reporting. What should the Device Template look like for the Panorama's? What about the firewalls themselves? I don't know if that's possible, but that would at least allow the file to then be associated with the node. My initial thought on this would be to see if there is some way that a command could be sent to the firewalls that would have them connect to the panorama and kick off the tgz backup for itself. Since the Panorama will be the central point of management for all of the firewalls, how would you recommend insuring that NCM properly associates the binary config backups with the proper firewall? In other words, with the Panorama handling all of the backups, how will NCM know which backup goes to which firewall? I've even included a few of my ideas below as well: I would just like to get a discussion around these since I think there is a potential fix here for the Panorma problem that others have posted about here on Thwack, so a community brainstorm could be helpful for a lot of us. I'm not necessarily looking for people that have all these answers, or any of them really.

#PALO ALTO PANORAMA HOW TO#

tgz backups on the firealls, I think it'd be possible to properly backup full DR config bundles through NCM via the Panorama tool for all of our firewalls, but I still have a few questions on how to manage them all in NCM. Now that NCM can handle Binary Configs and Panorama performs binary. Hi all, I've seen a few posts on Thwack about Panorama's but I haven't seen any good examples or solutions on how to properly manage them.

Palo alto panorama