Perform Initial Configuration for an Air Gapped M-Series Appliance
Table of Contents
9.1 (EoL)
Expand all | Collapse all
-
- Determine Panorama Log Storage Requirements
-
- Setup Prerequisites for the Panorama Virtual Appliance
- Perform Initial Configuration of the Panorama Virtual Appliance
- Set Up The Panorama Virtual Appliance as a Log Collector
- Set Up the Panorama Virtual Appliance with Local Log Collector
- Set up a Panorama Virtual Appliance in Panorama Mode
- Set up a Panorama Virtual Appliance in Management Only Mode
-
- Preserve Existing Logs When Adding Storage on Panorama Virtual Appliance in Legacy Mode
- Add a Virtual Disk to Panorama on an ESXi Server
- Add a Virtual Disk to Panorama on vCloud Air
- Add a Virtual Disk to Panorama on AWS
- Add a Virtual Disk to Panorama on Azure
- Add a Virtual Disk to Panorama on Google Cloud Platform
- Add a Virtual Disk to Panorama on KVM
- Add a Virtual Disk to Panorama on Hyper-V
- Mount the Panorama ESXi Server to an NFS Datastore
-
- Increase CPUs and Memory for Panorama on an ESXi Server
- Increase CPUs and Memory for Panorama on vCloud Air
- Increase CPUs and Memory for Panorama on AWS
- Increase CPUs and Memory for Panorama on Azure
- Increase CPUs and Memory for Panorama on Google Cloud Platform
- Increase CPUs and Memory for Panorama on KVM
- Increase CPUs and Memory for Panorama on Hyper-V
- Complete the Panorama Virtual Appliance Setup
-
- Convert Your Evaluation Panorama to a Production Panorama with Local Log Collector
- Convert Your Evaluation Panorama to a Production Panorama without Local Log Collector
- Convert Your Evaluation Panorama to VM-Flex Licensing with Local Log Collector
- Convert Your Evaluation Panorama to VM-Flex Licensing without Local Log Collector
- Convert Your Production Panorama to an ELA Panorama
-
- Register Panorama
- Activate a Panorama Support License
- Activate/Retrieve a Firewall Management License when the Panorama Virtual Appliance is Internet-connected
- Activate/Retrieve a Firewall Management License when the Panorama Virtual Appliance is not Internet-connected
- Activate/Retrieve a Firewall Management License on the M-Series Appliance
- Install the Panorama Device Certificate
-
- Migrate from a Panorama Virtual Appliance to an M-Series Appliance
- Migrate a Panorama Virtual Appliance to a Different Hypervisor
- Migrate from an M-Series Appliance to a Panorama Virtual Appliance
- Migrate from an M-100 Appliance to an M-500 Appliance
- Migrate from an M-100 or M-500 Appliance to an M-200 or M-600 Appliance
-
- Configure an Admin Role Profile
- Configure an Access Domain
-
- Configure a Panorama Administrator Account
- Configure Local or External Authentication for Panorama Administrators
- Configure a Panorama Administrator with Certificate-Based Authentication for the Web Interface
- Configure an Administrator with SSH Key-Based Authentication for the CLI
- Configure RADIUS Authentication for Panorama Administrators
- Configure TACACS+ Authentication for Panorama Administrators
- Configure SAML Authentication for Panorama Administrators
-
- Add a Firewall as a Managed Device
-
- Add a Device Group
- Create a Device Group Hierarchy
- Create Objects for Use in Shared or Device Group Policy
- Revert to Inherited Object Values
- Manage Unused Shared Objects
- Manage Precedence of Inherited Objects
- Move or Clone a Policy Rule or Object to a Different Device Group
- Push a Policy Rule to a Subset of Firewalls
- Manage the Rule Hierarchy
- Manage the Master Key from Panorama
- Redistribute User-ID Information to Managed Firewalls
-
- Plan the Transition to Panorama Management
- Migrate a Firewall to Panorama Management and Reuse Existing Configuration
- Migrate a Firewall to Panorama Management and Push a New Configuration
- Migrate a Firewall HA Pair to Panorama Management and Reuse Existing Configuration
- Migrate a Firewall HA Pair to Panorama Management and Push a New Configuration
- Load a Partial Firewall Configuration into Panorama
- Localize a Panorama Pushed Configuration on a Managed Firewall
-
- Add Standalone WildFire Appliances to Manage with Panorama
- Configure Basic WildFire Appliance Settings on Panorama
- Remove a WildFire Appliance from Panorama Management
-
-
- Configure a Cluster and Add Nodes on Panorama
- Configure General Cluster Settings on Panorama
- Remove a Cluster from Panorama Management
- Configure Appliance-to-Appliance Encryption Using Predefined Certificates Centrally on Panorama
- Configure Appliance-to-Appliance Encryption Using Custom Certificates Centrally on Panorama
- View WildFire Cluster Status Using Panorama
- Upgrade a Cluster Centrally on Panorama with an Internet Connection
- Upgrade a Cluster Centrally on Panorama without an Internet Connection
-
-
- Manage Licenses on Firewalls Using Panorama
-
- Supported Updates
- Schedule a Content Update Using Panorama
- Upgrade Log Collectors When Panorama Is Internet-Connected
- Upgrade Log Collectors When Panorama Is Not Internet-Connected
- Upgrade Firewalls When Panorama Is Internet-Connected
- Upgrade Firewalls When Panorama Is Not Internet-Connected
- Upgrade a ZTP Firewall
- Revert Content Updates from Panorama
-
- Preview, Validate, or Commit Configuration Changes
- Enable Automated Commit Recovery
- Compare Changes in Panorama Configurations
- Manage Locks for Restricting Configuration Changes
- Add Custom Logos to Panorama
- Use the Panorama Task Manager
- Reboot or Shut Down Panorama
- Configure Panorama Password Profiles and Complexity
-
-
- Verify Panorama Port Usage
- Resolve Zero Log Storage for a Collector Group
- Replace a Failed Disk on an M-Series Appliance
- Replace the Virtual Disk on an ESXi Server
- Replace the Virtual Disk on vCloud Air
- Migrate Logs to a New M-Series Appliance in Log Collector Mode
- Migrate Logs to a New M-Series Appliance in Panorama Mode
- Migrate Logs to a New M-Series Appliance Model in Panorama Mode in High Availability
- Migrate Logs to the Same M-Series Appliance Model in Panorama Mode in High Availability
- Migrate Log Collectors after Failure/RMA of Non-HA Panorama
- Regenerate Metadata for M-Series Appliance RAID Pairs
- Troubleshoot Registration or Serial Number Errors
- Troubleshoot Reporting Errors
- Troubleshoot Device Management License Errors
- Troubleshoot Automatically Reverted Firewall Configurations
- Complete Content Update When Panorama HA Peer is Down
- View Task Success or Failure Status
- Restore an Expired Device Certificate
- Downgrade from Panorama 9.1
End-of-Life (EoL)
Perform Initial Configuration for an Air Gapped M-Series Appliance
Initial configuration procedure for a standalone air gapped M-Series Panorama™
management server.
Perform the initial configuration for an air gapped M-Series appliance. By default,
Panorama has an IP address of 192.168.1.1 and a username/password of admin/admin.
For security reasons, you must change these settings before continuing with other
configuration tasks. You must perform these initial configuration tasks either from
the Management (MGT) interface or using a direct serial port connection to the
console port on the M-600, M-500, or M-200 appliance.
The air gapped Panorama cannot connect to the Palo Alto Networks update server
because an outbound internet connection is required. To activate licenses, upgrade
the PAN-OS software version, and install dynamic content updates you must upload the
relevant files to the air gapped Panorama manually.
If you are configuring an M-Series appliance in Log Collector mode with 10GB
interfaces, you must complete this entire configuration procedure for the 10GB
interfaces to display as Up.
- Gather the required information from your network administrator.
-
Private IP address for the management (MGT) port
-
Netmask
-
Default gateway
-
DNS server address
-
NTP server address
-
- Install and power on M-Series appliance.Review your M-Series appliance hardware reference guide for details and best practices.
- Connect to the M-Series appliance.You must log in using the default admin username. You are immediately prompted to change the default admin password before you can continue. The new password must be a minimum of eight characters and include a minimum of one lowercase and one uppercase character, as well as one number or special character.You can connect to the M-Series appliance in one of the following ways:
- Connect a serial cable from your computer to the Console port and connect to the M-Series appliance using terminal emulation software (9600-8-N-1). Wait a few minutes for the boot-up sequence to complete; when the M-Series appliance is ready, the prompt changes to the name of the M-Series, for example M-500 login.
- Log in to the Panorama CLI by connecting an
RJ-45 Ethernet cable from your computer to the MGT interface on the
M-Series appliance. From a browser, go to
https://192.168.1.1.You may need to change the IP address on your computer to an address in the 192.168.1.0/24 network, such as 192.168.1.2, to access this URL.
- Configure the network settings for the air gapped M-Series appliance.The following commands set the interface IP allocation to static, configures the IP address for the MGT interface, the Domain Name Server (DNS), and Network Time Protocol (NTP) server.admin> configureadmin# set deviceconfig system type staticadmin# set deviceconfig system ip-address <IP-Address> netmask <Netmask-IP> default-gateway <Gateway-IP>admin# set deviceconfig system dns-settings servers primary <IP-Address> secondary <IP-Address>admin# set deviceconfig system ntp-servers primary-ntp-server ntp-server-address <IP-Address>admin# set deviceconfig system ntp-servers secondary-ntp-server ntp-server-address <IP-Address>
- Register the M-Series appliance with the Palo Alto Networks Customer Support Portal (CSP).
- Log in to the Palo Alto Networks CSP.
- Click Register a Device.
- Select Register device using Serial Number and click Next.
- Enter the required Device
Information.
-
Enter the M-Series appliance Serial Number.
-
Check (enable) Device will be used offline.
-
Select the PAN-OS OS Release running on the M-Series appliance.
-
- Enter the required Location
Information.
-
Enter the City the M-Series appliance is located in,
-
Enter the Postal Code the M-Series appliance is located in,
-
Enter the Country the M-Series appliance is located in.
-
- Agree and Submit.
- Skip this step when prompted to generate the optional Day 1 Configuration config file.
- Download the Panorama license keys.
The license key files are required to activate your Panorama licenses when air gapped.- Log in to the Palo Alto Networks CSP.
- Select ProductDevices and locate the M-Series appliance you added.
- Download all license keys files from the download links available
License column.You must download a license key file for each license you want to active on Panorama.
- Active the Panorama licenses.
- Log in to the Panorama web interface.
- Select PanoramaLicenses and Manually upload license
key.Click Choose File to select the license key file you downloaded in the previous step and click OK.
- Repeat this step to uploaded and activate all licenses.
- (Optional) Configure general Panorama settings as needed.
- Select PanoramaSetupManagement and edit the General Settings.
- Enter a Hostname for Panorama and enter your network Domain name. The domain name is just a label; it will not be used to join the domain.
- Enter Login Banner text that informs users who
are about to log in that they require authorization to access the
Panorama management functions.As a best practice, avoid using welcoming verbiage. Additionally, you should ask your legal department to review the banner message to ensure it adequately warns that unauthorized access is prohibited.
- Enter the Latitude and Longitude to enable accurate placement of the M-Series on the world map.
- Click OK.
- Commit and Commit to Panorama.
- Upgrade the PAN-OS and dynamic content versions on Panorama.
Review the PAN-OS Release Notes for detailed information about your target PAN-OS upgrade version.- Log in to the Palo Alto Networks CSP.
- Download dynamic content updates.
-
Select UpdatesDynamic Updates.
-
Select the dynamic Content type you want to install.
-
Download the dynamic content update to your local device.
-
Repeat this step to download all required dynamic content updates.
-
- Download a PAN-OS software update.
-
Select UpdatesSoftware Updates.
-
For the Content type, select Panorama M Base. For the Release type, select All(default) or Preferred.
-
In the Download column, click the PAN-OS version to download the software image to your local device.
-
- Log in to the Panorama web interface.
- Select PanoramaDynamic Updates and Upload the dynamic content
updates you downloaded.Repeat this step to Browse and select all the dynamic content release versions.
- Install the dynamic content updates.
- Select PanoramaSoftware and Upload the PAN-OS software image you download.
- Install the PAN-OS software version.Panorama needs to restart to finish installing the PAN-OS software upgrade.
- Connect Panorama to your network.
- Disconnect Panorama from your computer.
- Connect the MGT port to a switch port on your management network using an RJ-45 Ethernet cable. Make sure that the switch port you cable on Panorama is configured for autonegotiation.
- Register the M-Series appliance with the Palo Alto Networks Customer Support Portal (CSP).