Panorama™ Administrator’s Guide Version 7.1 Contact Information Corporate Headquarters: Palo Alto Networks 4401 Great America Parkway Santa Clara, CA 95054 www.paloaltonetworks.com/company/contact‐us About this Guide This guide describes how to set up and use Panorama™ for centralized management; it is intended for administrators who want the basic framework to quickly set up the Panorama virtual appliance or the M‐Series appliance for centralized administration of Palo Alto Networks firewalls If you have an M‐Series appliance, this guide takes over after you finish rack mounting your M‐Series appliance For more information, refer to the following sources: For information on how to configure other components in the Palo Alto Networks Next‐Generation Security Platform, go to the Technical Documentation portal: https://www.paloaltonetworks.com/documentation or search the documentation For access to the knowledge base, complete documentation set, discussion forums, and videos, refer to https://live.paloaltonetworks.com For contacting support, for information on support programs, to manage your account or devices, or to open a support case, refer to https://www.paloaltonetworks.com/support/tabs/overview.html For the most current PAN‐OS and Panorama 7.1 release notes, go to https://www.paloaltonetworks.com/documentation/71/pan‐os/pan‐os‐release‐notes.html To provide feedback on the documentation, please write to us at: documentation@paloaltonetworks.com PaloAltoNetworks,Inc www.paloaltonetworks.com â2016PaloAltoNetworks,Inc.PaloAltoNetworksisaregisteredtrademarkofPaloAltoNetworks.Alistofourtrademarkscanbefound athttp://www.paloaltonetworks.com/company/trademarks.html.Allothermarksmentionedhereinmaybetrademarksoftheir respectivecompanies RevisionDate:August15,2016 ã Panorama7.1AdministratorsGuide âPaloAltoNetworks,Inc Table of Contents Panorama Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . About Panorama . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Panorama Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Centralized Configuration and Deployment Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Context Switch—Firewall or Panorama . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Templates and Template Stacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Device Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Centralized Logging and Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Logging Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Managed Collectors and Collector Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Caveats for a Collector Group with Multiple Log Collectors . . . . . . . . . . . . . . . . . . . . . . . . . 20 Centralized Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Panorama Commit and Validation Operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Role‐Based Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Administrative Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Authentication Profiles and Sequences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Access Domains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Administrative Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Panorama Recommended Deployments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Panorama for Centralized Management and Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Panorama in a Distributed Log Collection Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Plan Your Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Deploy Panorama: Task Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Set Up Panorama . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Determine Panorama Log Storage Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Set Up the Panorama Virtual Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Setup Prerequisites for the Panorama Virtual Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Install the Panorama Virtual Appliance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Perform Initial Configuration of the Panorama Virtual Appliance . . . . . . . . . . . . . . . . . . . . 42 Expand Log Storage Capacity on the Panorama Virtual Appliance . . . . . . . . . . . . . . . . . . . 45 Increase CPUs and Memory on the Panorama Virtual Appliance . . . . . . . . . . . . . . . . . . . . . 47 Complete the Panorama Virtual Appliance Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Set Up the M‐Series Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Perform Initial Configuration of the M‐Series Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Set up the M‐Series Appliance as a Log Collector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Increase Storage on the M‐Series Appliance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Register Panorama and Install Licenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 Register Panorama . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 Activate a Panorama Support License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 Activate/Retrieve a Firewall Management License on the Panorama Virtual Appliance. . 67 Activate/Retrieve a Firewall Management License on the M‐Series Appliance . . . . . . . . . 68 © Palo Alto Networks, Inc Panorama 7.1 Administrator’s Guide • 3 Table of Contents Install Content and Software Updates for Panorama . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Panorama, Log Collector, and Firewall Version Compatibility . . . . . . . . . . . . . . . . . . . . . . . 70 Install Updates for Panorama with HA Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Install Updates for Panorama with Internet Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Install Updates for Panorama without Internet Connection . . . . . . . . . . . . . . . . . . . . . . . . 74 Transition to a Different Panorama Platform . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Migrate from a Panorama Virtual Appliance to an M‐Series Appliance . . . . . . . . . . . . . . . 78 Migrate from an M‐100 Appliance to an M‐500 Appliance . . . . . . . . . . . . . . . . . . . . . . . . . 81 Access and Navigate Panorama Management Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Log in to the Panorama Web Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Navigate the Panorama Web Interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Log in to the Panorama CLI. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 Set Up Administrative Access to Panorama . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Configure an Admin Role Profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Configure an Access Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Configure Administrative Accounts and Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Configure an Administrative Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Configure an Administrator with Kerberos SSO, External, or Local Authentication . . . . 89 Configure an Administrator with Certificate‐Based Authentication for the Web Interface . 90 Configure an Administrator with SSH Key‐Based Authentication for the CLI . . . . . . . . . 91 Configure RADIUS Vendor‐Specific Attributes for Administrator Authentication . . . . . . 92 Manage Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .95 Add a Firewall as a Managed Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96 Manage Device Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Add a Device Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 Create a Device Group Hierarchy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Create Objects for Use in Shared or Device Group Policy . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Revert to Inherited Object Values . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .101 Manage Unused Shared Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .101 Manage Precedence of Inherited Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .102 Move or Clone a Policy Rule or Object to a Different Device Group . . . . . . . . . . . . . . . . .102 Select a URL Filtering Vendor on Panorama . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .103 Push a Policy Rule to a Subset of Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .107 Manage the Rule Hierarchy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .108 Manage Templates and Template Stacks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110 Template Capabilities and Exceptions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110 Add a Template . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .110 Configure a Template Stack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .112 Override a Template Setting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .113 Disable/Remove Template Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .114 Transition a Firewall to Panorama Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .115 PlantheTransitiontoPanoramaManagement ...................................115 MigrateaFirewalltoPanoramaManagement.....................................116 LoadaPartialFirewallConfigurationintoPanorama ..............................120 ã Panorama7.1AdministratorsGuide âPaloAltoNetworks,Inc Table of Contents Use Case: Configure Firewalls Using Panorama. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Device Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 Set Up Your Centralized Configuration and Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Manage Log Collection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .131 Configure a Managed Collector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Manage Collector Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Configure a Collector Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Move a Log Collector to a Different Collector Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139 Remove a Firewall from a Collector Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 Configure Log Forwarding to Panorama . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142 Verify Log Forwarding to Panorama . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 Modify Log Forwarding and Buffering Defaults. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146 Configure Log Forwarding from Panorama to External Destinations. . . . . . . . . . . . . . . . . . . . 148 Log Collection Deployments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Plan a Log Collection Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 Deploy Panorama with Dedicated Log Collectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152 Deploy Panorama with Default Log Collectors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 Deploy Panorama Virtual Appliances with Local Log Collection . . . . . . . . . . . . . . . . . . . 165 Manage Licenses and Updates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .167 Manage Licenses on Firewalls Using Panorama . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 Deploy Updates to Firewalls and Log Collectors Using Panorama . . . . . . . . . . . . . . . . . . . . . 169 Supported Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169 Schedule a Content Update Using Panorama . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170 Deploy an Update to Log Collectors when Panorama is Internet‐connected . . . . . . . . 170 Deploy an Update to Log Collectors when Panorama is not Internet‐connected . . . . . 172 Deploy an Update to Firewalls when Panorama is Internet‐connected . . . . . . . . . . . . . 174 Deploy an Update to Firewalls when Panorama is not Internet‐connected . . . . . . . . . . 175 Monitor Network Activity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .179 Use Panorama for Visibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 Monitor the Network with the ACC and AppScope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 Analyze Log Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182 Generate, Schedule, and Email Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182 Use Case: Monitor Applications Using Panorama . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 Use Case: Respond to an Incident Using Panorama . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 Incident Notification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 Review the Widgets in the ACC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189 Review Threat Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189 Review WildFire Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190 ReviewDataFilteringLogs.................................................... 190 UpdateSecurityRules ....................................................... 191 âPaloAltoNetworks,Inc Panorama7.1AdministratorsGuide ã TableofContents Panorama High Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193 Panorama HA Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .194 Priority and Failover on Panorama in HA. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .195 Failover Triggers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .197 HA Heartbeat Polling and Hello Messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .197 HA Path Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .197 Logging Considerations in Panorama HA. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .199 Logging Failover on a Panorama Virtual Appliance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .199 Logging Failover on an M‐Series Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .200 Synchronization Between Panorama HA Peers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .201 Manage a Panorama HA Pair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .202 Set Up HA on Panorama . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .202 Test Panorama HA Failover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .204 Switch Priority after Panorama Failover to Resume NFS Logging . . . . . . . . . . . . . . . . . . .204 Restore the Primary Panorama to the Active State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .205 Administer Panorama. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207 Preview, Validate, or Commit Configuration Changes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .208 Manage Panorama and Firewall Configuration Backups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .209 Schedule Export of Configuration Files. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .209 Back Up Panorama and Firewall Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .210 Restore a Panorama Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .211 Configure the Maximum Number of Configuration Backups on Panorama . . . . . . . . . . .212 Load a Configuration Backup on a Managed Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .213 Compare Changes in Panorama Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .214 Manage Locks for Restricting Configuration Changes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .215 Add Custom Logos to Panorama . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .217 Use the Panorama Task Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .218 Manage Storage Quotas and Expiration Periods for Logs and Reports . . . . . . . . . . . . . . . . . . .219 Log and Report Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .219 Log and Report Expiration Periods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .219 Configure Storage Quotas and Expiration Periods for Logs and Reports . . . . . . . . . . . . .220 Monitor Panorama . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .222 Panorama System and Configuration Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .222 Monitor Panorama and Log Collector Statistics Using SNMP . . . . . . . . . . . . . . . . . . . . . . .223 Reboot or Shut Down Panorama. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .225 Configure Panorama Password Profiles and Complexity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .226 Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 Troubleshoot Panorama System Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .228 Generate Diagnostic Files for Panorama . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .228 Diagnose Panorama Suspended State. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .228 Monitor the File System Integrity Check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .228 Manage Panorama Storage for Software and Content Updates . . . . . . . . . . . . . . . . . . . . .229 Recover from Split Brain in Panorama HA Deployments. . . . . . . . . . . . . . . . . . . . . . . . . . . .229 ã Panorama7.1AdministratorsGuide âPaloAltoNetworks,Inc TableofContents TroubleshootLogStorageandConnectionIssues.................................... 231 VerifyPanoramaPortUsage .................................................. 231 Resolve Zero Log Storage for a Collector Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232 Replace a Failed Disk on an M‐Series Appliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232 Replace the Virtual Disk on an ESXi Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233 Replace the Virtual Disk on vCloud Air . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233 Migrate Logs to a New M‐Series Appliance in Log Collector Mode . . . . . . . . . . . . . . . . . 234 Migrate Logs to a New M‐Series Appliance in Panorama Mode . . . . . . . . . . . . . . . . . . . 238 Migrate Log Collectors after Failure/RMA of Non‐HA Panorama. . . . . . . . . . . . . . . . . . . 243 Regenerate Metadata for M‐Series Appliance RAID Pairs . . . . . . . . . . . . . . . . . . . . . . . . . 246 Replace an RMA Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247 Partial Device State Generation for Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247 Before Starting RMA Firewall Replacement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247 Restore the Firewall Configuration after Replacement . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 Troubleshoot Commit Failures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251 Troubleshoot Registration or Serial Number Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252 Troubleshoot Reporting Errors ................................................... 253 ViewTaskSuccessorFailureStatus ............................................... 254 âPaloAltoNetworks,Inc Panorama7.1AdministratorsGuide ã TableofContents ã Panorama7.1AdministratorsGuide âPaloAltoNetworks,Inc PanoramaOverview PanoramaprovidescentralizedmonitoringandmanagementofmultiplePaloAltoNetworksnextgeneration firewalls.Itprovidesasinglelocationfromwhichyoucanoverseeallapplications,users,andcontent traversingyournetwork,andthenusethisknowledgetocreateapplicationenablementpoliciesthatprotect andcontrolthenetwork.UsingPanoramaforcentralizedpolicyandfirewallmanagementincreases operational efficiency in managing and maintaining a distributed network of firewalls. About Panorama Panorama Platforms Centralized Configuration and Deployment Management Centralized Logging and Reporting Panorama Commit and Validation Operations Role‐Based Access Control Panorama Recommended Deployments Plan Your Deployment Deploy Panorama: Task Overview © Palo Alto Networks, Inc Panorama 7.1 Administrator’s Guide • 9 About Panorama Panorama Overview About Panorama Panorama provides centralized management of Palo Alto Networks next‐generation firewalls, as the following figure illustrates: Panorama allows you to effectively configure, manage, and monitor your Palo Alto Networks firewalls using central oversight with local control, as required. The three focal areas in which Panorama adds value are: Centralized configuration and deployment—To simplify central management and rapid deployment of the firewalls on your network, use Panorama to pre‐stage the firewalls for deployment. You can then assemble the firewalls into groups, and create templates to apply a base network and device configuration and use device groups to administer globally shared and local policy rules. See Centralized Configuration and Deployment Management Aggregated logging with central oversight for analysis and reporting—Collect information on activity across all the managed firewalls on the network and centrally analyze, investigate and report on the data. This comprehensive view of network traffic, user activity, and the associated risks empowers you to respond to potential threats using the rich set of policies to securely enable applications on your network. See Centralized Logging and Reporting Distributed administration—Allows you to delegate or restrict access to global and local firewall configurations and policies. See Role‐Based Access Control for delegating appropriate levels of access for distributed administration Panorama is available in two platforms: as a virtual appliance and as a dedicated hardware appliance. For more information, see Panorama Platforms 10 • Panorama 7.1 Administrator’s Guide © Palo Alto Networks, Inc ... one Log Collector in the Collector Group becomes unavailable. Each log will have two copies and each copy? ?will reside on a different Log Collector. Log redundancy is available only if each Log Collector has ... Enabling redundancy doubles the log processing traffic in a Collector Group, which reduces its maximum logging rate by half, as each Log Collector must distribute a? ?copy? ?of each log it receives Obtain an On‐Site‐Spare (OSS) to enable prompt replacement if a Log Collector failure occurs