Register Panorama with the ZTP Service for Existing Deployments

1. Install the Panorama Device Certificate.
2. Log in to the Palo Alto Networks Customer Support Portal (CSP).
3. Associate your Panorama with the ZTP Service on the Palo Alto Networks CSP.

   The ZTP Service supports associating up to two Panoramas only if they are in a high availability (HA) configuration. If Panorama is not in an HA configuration, only a single Panorama can be associated.

   1. Select AssetsZTP Service and Modify Association.
   2. Select the serial number of the Panorama managing your ZTP firewalls.
   3. (HA only) Select the serial number of the Panorama HA peer.
   4. Click OK.
4. Log in to the Panorama Web Interface.
5. Select PanoramaZero Touch ProvisioningSetup and edit the General ZTP settings.
6. Register Panorama with the ZTP service.

   1. Enable ZTP Service.
   2. Enter the Panorama FQDN or IP Address.

      This is the FQDN or public IP address of the Panorama the ZTP plugin is installed on and that the CSP pushes to the ZTP firewalls.

      (Managed firewalls running PAN-OS 10.1.4 and earlier releases) Enter the Panorama IP address to avoid the managed firewall disconnecting from Panorama on reboot or after a successful PAN-OS upgrade.

      If you need to use the Panorama FQDN, configure a static destination route to avoid the managed firewall disconnecting from Panorama on reboot or after a successful PAN-OS upgrade.
   3. (HA only) Enter the Peer FQDN or IP Address.

      This is the FQDN or public IP address of the Panorama peer on which the ZTP plugin is installed and that the CSP pushes to the ZTP firewalls in case of failover.

      (Managed firewalls running PAN-OS 10.1.4 and earlier releases) Enter the Panorama IP address to avoid the managed firewall disconnecting from Panorama on reboot or after a successful PAN-OS upgrade.

      If you need to use the Panorama FQDN, configure a static destination route to avoid the managed firewall disconnecting from Panorama on reboot or after a successful PAN-OS upgrade.
   4. Click OK to save your configuration changes.

7. Modify the ZTP device group, templates, and template stack as needed.

   Moving a ZTP firewall to a different device group or template stack is not supported. You must keep the ZTP onboarded firewalls in the ZTP device group and templates that were created. This is required for the firewall to maintain connectivity with Panorama and prevent any unintended configuration reverts on the firewall.

   When considering your device group hierarchy and template priority in your template stack, ensure that the device group and template containing the required ZTP configuration that allows the ZTP firewall and Panorama to communicate have priority such that the configuration is not overridden in the event of conflicting configurations.

   If modifying the ZTP device group and template used to onboard the ZTP firewall, be careful to not modify any of the ZTP configuration that was automatically populated when you created the device group and template in the previous step. This includes configurations like the Panorama IP address, virtual router, the ethernet1/1 interface, Security zone of the ethernet1/1 interface, the loopback.900 loopback interface, the rule1 Security policy rule, ztp-nat NAT policy rule, and the service route. These configurations are required to connect your ZTP firewall to Panorama and can lead to connectivity issues if modified.
8. Select Commit and Commit to Panorama
9. Sync to ZTP Service and verify that the Panorama Sync Status displays as In Sync.

10. Add ZTP Firewalls to Panorama.