98
•
Panorama
6.1
Administrator’s
Guide
©
Palo
Alto
Networks,
Inc.
Transition
a
Firewall
to
Panorama
Management
Manage
Firewalls
Transition
a
Firewall
to
Panorama
Management
If
you
have
already
deployed
Palo
Alto
Networks
firewalls
and
configured
them
locally,
but
now
want
to
start
using
Panorama
for
centrally
managing
them,
you
have
pre
‐
migration
planning,
implementation
and
post
‐
migration
verification
tasks.
This
high
‐
level
overview
does
not
address
all
the
critical
tasks
required
to
plan,
implement,
and
validate
the
transition
to
centralized
administration.
Here
are
the
high
‐
level
planning
and
configuration
activities.
On
Panorama,
add
the
devices
and
create
device
groups
to
logically
assemble
firewalls
or
virtual
systems
that
perform
a
similar
role,
or
function
or
that
have
similar
characteristics.
Create
common
zones
for
each
device
group.
Decide
on
the
common
zone
‐
naming
strategy
for
all
devices
and
virtual
systems
in
a
device
group.
For
example,
if
you
have
two
zones
called
Branch
LAN
and
WAN,
Panorama
can
centrally
push
policies
that
reference
those
zones
without
being
aware
of
the
variations
in
port/media
type,
platform
or
the
logical
addressing
schema.
You
must
create
the
zones
on
each
managed
device
before
you
can
commit
the
changes
to
the
device
group
or
template.
Panorama
cannot
poll
the
devices
for
zone
name
or
configuration.
Configure
each
device
to
communicate
with
Panorama.
You
must
define
the
Panorama
IP
addresses
(primary
and
secondary
Panorama)
on
each
device.
Use
device
groups
to
create
common
policies
for
devices
with
similar
functionality
and
use
templates
to
define
a
common
base
configuration
for
the
managed
device.
Determine
how
you
will
manage
local
rules
and
device
‐
specific
exceptions
to
common
policies
and
configuration
settings.
If
you
plan
to
use
locally
configured
rules
on
the
devices,
make
sure
that
the
names
of
the
rules
are
unique.
A
good
way
to
ensure
this
would
be
to
add
a
suffix
or
a
prefix
to
all
existing
rules.
Consider
removing
all
“deny
rules”
in
local
security
policy
and
use
Panorama
post
‐
rules.
This
approach
allows
you
to
temporarily
disable
local
rules
and
test
the
shared
post
‐
rules
pushed
from
Panorama.
You
can
then
test
the
post
‐
rules,
make
adjustments
as
necessary
and
eliminate
local
administration
on
the
device.
Verify
that
the
firewalls
function
as
efficiently
with
Panorama
‐
pushed
configuration
as
they
did
with
local
configuration.
For
detailed
information
on
using
the
XML
API
to
perform
the
transition,
refer
to
the
document
Because
Palo
Alto
Networks
Technical
Support
does
not
help
troubleshoot
issues
when
using
the
XML
API,
if
you
do
not
have
experience
with
scripting/using
the
XML
API,
contact
Palo
Alto
Networks
Professional
Services
to
learn
about
the
firewall
migration
process.
