: Set up a Panorama Virtual Appliance in Management Only Mode
Focus
Focus

Set up a Panorama Virtual Appliance in Management Only Mode

Table of Contents

Set up a Panorama Virtual Appliance in Management Only Mode

Change the Panorama virtual appliance on AWS, AWS GovCloud, Azure, Google Cloud Platform, KVM, Hyper-V, ESXi or vCloud air in Management Only mode.
Management Only mode allows the Panorama virtual appliance to operate strictly as a Panorama management server without local log collection capabilities. By default, the Panorama virtual appliance is in Panorama mode for the initial deployment. It is recommended to change the Panorama virtual appliance to Management Only immediately after the initial deployment because changing to Management Only mode requires that there are no logs being forwarded to the Panorama management server because the Panorama virtual appliance in Management Only mode does not support log collection. After you change to Management Only mode, any existing log data stored on the Panorama virtual appliance becomes inaccessible, and the ACC and reporting features cannot query the logs stored on the Panorama virtual appliance.
(Panorama in Legacy mode) There is no impact to the Panorama virtual appliance when you change the Panorama virtual appliance from Legacy mode to Management Only mode. As a precaution, Palo Alto Networks recommends taking a virtual machine snapshot of your Panorama virtual appliance that you can use to restore Panorama in the event of unexpected impact.
If you configured a local Log Collector, the local Log Collector still exists on Panorama when you change to Management Only mode despite having no log collection capabilities. Deleting the local Log Collector (PanoramaManaged Collectors) deletes the Eth1/1 interface configuration the local Log Collector uses by default. If you decide to delete the local Log Collector, you must reconfigure the Eth1/1 interface.
  1. Switch to Management Only mode.
    1. Change to Management Only mode:
      > request system system-mode management-only
    2. Enter Y to confirm the mode change. The Panorama virtual appliance reboots. If the reboot process terminates your terminal emulation software session, reconnect to the Panorama virtual appliance to see the Panorama login prompt.
      If you see a CMS Login prompt, this means the Panorama virtual appliance has not finished rebooting. Press Enter at the prompt without typing a username or password.
  2. Verify that the switch to Management Only mode succeeded.
    1. Log back in to the CLI.
    2. Verify that the switch to Management Only mode succeeded:
      > show system info | match system-mode
      If the mode change succeeded, the output displays:
      > system mode:management-only