ZTP Configuration Elements

• Customer Support Portal (CSP) Account—The ZTP service uses the Palo Alto Networks Customer Support Portal to register the firewall with your account and identify the tenants that you can associate with your ZTP firewall.
• Tenant—The Strata Cloud Manager tenant the ZTP firewall will be associated with. This is a logical container for your apps and devices.
• Business Administrator or Superuser Role—The enterprise roles that can onboard a ZTP firewall. These roles are assigned through Common Services.
• Claim Key—Eight-digit numeric key physically attached to the ZTP firewall used to register the ZTP firewall with the CSP.
• Serial Number—A 10-32 character alphanumeric identifier attached to the ZTP firewall. You can find this on a sticker on the back of the firewall.
• Activation URL—URL used to onboard your ZTP firewall to cloud management.
  ztpdeviceactivation

1. Business Administrator or higher role activates a ZTP firewall by visiting the ZTP activation URL and the firewall serial number and claim key. If you have more than one tenant or CSP account, you can select which one you want to associate with the firewall.
2. The ZTP firewall registers with the CSP and with the Strata Cloud Manager tenant specified during activation.
3. A ZTP firewall successfully registered with the ZTP service automatically appears in Strata Cloud Manager (Settings > Firewall Setup > Device Management).
4. When the firewall connects to the internet, the ZTP firewall requests a device certificate from the CSP in order to connect to the ZTP service.
5. The ZTP service pushes the Strata Cloud Manager FQDN and the ZTP configuration to the firewall.
6. The ZTP firewall connects to Strata Cloud Manager.