©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
27
Panorama
Overview
Plan
Your
Deployment
Plan
Your
Deployment
Determine
the
management
approach.
Do
you
plan
to
use
Panorama
to
centrally
configure
and
manage
the
policies,
to
centrally
administer
software,
content
and
license
updates,
and/or
centralize
logging
and
reporting
across
the
managed
devices
in
the
network?
If
you
already
deployed
and
configured
the
Palo
Alto
Networks
firewalls
on
your
network,
determine
whether
to
transition
the
devices
to
centralized
management.
This
process
requires
a
migration
of
all
configuration
and
policies
from
your
firewalls
to
Panorama.
For
details,
see
.
Verify
that
Panorama
is
on
the
same
release
version
or
a
later
version
than
the
firewalls
that
it
will
manage.
For
example,
Panorama
with
version
4.0
cannot
manage
firewalls
running
PAN
‐
OS
5.0.
For
versions
within
the
same
feature
release,
although
Panorama
can
manage
firewalls
running
a
later
version
of
PAN
‐
OS,
Palo
Alto
Networks
recommends
that
Panorama
run
the
same
version
or
a
later
version.
For
example,
if
Panorama
runs
6.0.3,
it
is
recommended
that
all
managed
firewalls
run
PAN
‐
OS
6.0.3
or
earlier
versions.
Plan
to
use
the
same
URL
filtering
database
(BrightCloud
or
PAN
‐
DB)
across
all
managed
firewalls.
If
some
firewalls
are
using
the
BrightCloud
database
and
others
are
using
PAN
‐
DB,
Panorama
can
only
manage
security
policies
for
one
or
the
other
URL
filtering
database.
URL
filtering
rules
for
the
other
database
must
be
managed
locally
on
the
firewalls
that
use
that
database.
Plan
to
use
Panorama
in
a
high
availability
configuration;
set
it
up
as
an
active/passive
high
availability
pair.
See
Estimate
the
log
storage
capacity
your
network
needs
to
meet
security
and
compliance
requirements.
Consider
such
factors
as
the
network
topology,
number
of
firewalls
sending
logs,
type
of
log
traffic
(for
example,
URL
and
threat
logs
versus
traffic
logs),
the
rate
at
which
firewalls
generate
logs,
and
the
number
of
days
for
which
you
want
to
store
logs
on
Panorama.
For
details,
see
.
For
meaningful
reports
on
network
activity,
plan
a
logging
solution:
–
Do
you
need
to
forward
logs
to
a
syslog
server,
in
addition
to
Panorama?
–
If
you
need
a
long
‐
term
storage
solution,
do
you
have
a
Security
Information
and
Event
Management
(SIEM)
solution,
such
as
Splunk
or
ArcSight,
to
which
you
need
to
forward
logs?
–
Do
you
need
redundancy
in
logging?
With
Panorama
virtual
appliances
in
HA,
each
peer
can
log
to
its
virtual
disk.
The
managed
devices
can
send
logs
to
both
peers
in
the
HA
pair.
This
option
provides
redundancy
in
logging
and
is
best
suited
to
support
up
to
2TB
of
log
storage
capacity.
–
Will
you
log
to
a
Network
File
System
(NFS)?
Only
the
Panorama
virtual
appliance
supports
NFS.
Consider
using
NFS
if
more
than
2TB
of
log
storage
capacity
is
required.
If
using
NFS,
note
that
the
managed
devices
can
send
logs
only
to
the
primary
peer
in
the
HA
pair,
and
only
the
active
‐
primary
Panorama
is
mounted
to
the
NFS
and
can
write
to
it.
If
your
logging
solution
includes
M
‐
100
appliances,
by
default
they
use
the
management
(MGT)
interface
for
configuration,
log
collection,
and
Collector
Group
communication.
However,
it
is
a
best
practice
to
use
the
Eth1
or
Eth2
interfaces
for
log
collection
and
Collector
Group
communication
to
improve
security,
control
traffic
prioritization,
performance,
and
scalability.
Determine
whether
your
solution
would
benefit
from
using
separate
interfaces
for
these
functions.
For
details,
see
Determine
what
access
privileges,
roles,
and
permissions
administrators
require
to
access
to
the
managed
firewalls
and
Panorama.
See
.
Plan
the
required
.
To
do
this,
determine
whether
to
group
firewalls
based
on
function,
security
policy,
geographic
location,
or
network
segmentation.
An
example
of
a
function
‐
based
device
