Vues :

Migrate a Firewall to Panorama Management

 

When you import a firewall configuration, Panorama automatically creates a template to contain the imported network and device settings. To contain the imported policies and objects, Panorama automatically creates one device group for each firewall or one device group for each virtual system (vsys) in a multi-vsys firewall.

When you perform the following steps, Panorama imports the entire firewall configuration. Alternatively, you can Load a Partial Firewall Configuration into Panorama.

To migrate a firewall HA pair to Panorama management, see Migrate a Firewall HA Pair to Panorama Management.

Panorama can import configurations from firewalls that run PAN-OS 5.0 or later releases and can push configurations to those firewalls. The exception is that Panorama 6.1 and later releases cannot push configurations to firewalls running PAN-OS 6.0.0 through 6.0.3.
Panorama can import configurations from firewalls that are already managed devices but only if they are not already assigned to device groups or templates.
  • Plan the migration.
  • Add the firewall as a managed device.
    • Log in to the Panorama Web Interface and select 
      Panorama
      Managed Devices
      Summary
       to 
      Add
       a firewall as a managed device.
    • Enter the serial number of the firewall and click 
      OK
      .
      If you will import multiple firewall configurations, enter the serial number of each one on a separate line. Optionally, you can copy and paste the serial numbers from a Microsoft Excel worksheet.
    • Select 
      Commit
      Commit to Panorama
       and 
      Commit
       your changes.
  • Set up a connection from the firewall to Panorama.
    • Log in to the firewall web interface and select 
      Device
      Setup
       to edit the Panorama Settings.
    • In the 
      Panorama Servers
       fields, enter the IP addresses of the Panorama management server.
    • Click 
      OK
       and 
      Commit
      .
  • Import the firewall configuration into Panorama.
    If you later decide to re-import a firewall configuration, first remove the firewall device groups and template to which it is a member. If the device group and template names are the same as the firewall hostname, then you can delete the device group and template before re-importing the firewall configuration or use the 
    Device Group Name Prefix
     fields to define new names for the device group and template created by the re-import. Additionally, firewalls don’t lose logs when you remove them from device groups or templates.
    • From Panorama, select 
      Panorama
      Setup
      Operations
      , click 
      Import device configuration to Panorama
      , and select the 
      Device
      .
      Panorama can’t import a configuration from a firewall that is assigned to an existing device group or template.
    • (
      Optional
      ) Edit the 
      Template Name
      . The default value is the firewall name. You can’t use the name of an existing template or template stack.
    • (
      Optional
      ) Edit the 
      Device Group
       names. For a multi-vsys firewall, each device group has a vsys name by default, so add a character string as a Device Group Name Prefix for each. Otherwise, the default value is the firewall name. You can’t use the names of existing device groups.
      The 
      Import devices' shared objects into Panorama's shared context
       check box is selected by default, which means Panorama compares imports objects that belong to the Shared location in the firewall to Shared in Panorama. If an imported object is not in the Shared context of the firewall, it is applied to each device group being imported. If you clear the check box, Panorama copies will not compare imported objects, and apply all shared firewall objects into device groups being imported instead of Shared. This could create duplicate objects, so selecting the check box is a best practice in most cases. To understand the consequences of importing shared or duplicate objects into Panorama, see Plan how to manage shared settings.
    • Select a 
      Rule Import Location
       for the imported policy rules: 
      Pre Rulebase
       or 
      Post Rulebase
      . Regardless of your selection, Panorama imports default security rules (intrazone-default and interzone-default) into the post-rulebase.
      If Panorama has a rule with the same name as a firewall rule that you import, Panorama displays both rules. Delete one of the rules before performing a Panorama commit to prevent a commit error.
    • Click 
      OK
      . Panorama displays the import status, result, details about your selections, details about what was imported, and any warnings. Click 
      Close
      .
    • Select 
      Commit
      Commit to Panorama
       and 
      Commit
       your changes.
  • Push the configuration bundle from Panorama to the newly added firewall to remove all policy rules and objects from its local configuration.
    This step is necessary to prevent duplicate rule or object names, which would cause commit errors when you push the device group configuration from Panorama to the firewall in the next step.
    Pushing the imported firewall configuration from Panorama to remove local firewall configuration updates 
    Policy 
    rule 
    Creation
     and 
    Modified
     dates to reflect the date you pushed to your newly managed firewalls when you monitor policy rule usage for a managed firewall. Additionally, a new universially unique identifier (UUID) for each policy rule is created.
    This step is required to successfully migrate firewall management to the Panorama management server. Failure to perform this step successfully causes configuration errors and commit failures.
    • Select 
      Panorama
      Setup
      Operations
       and 
      Export or push device config bundle
      .
    • Select the 
      Device
       from which you imported the configuration and click 
      OK
      .
      If a master key is configured, 
      Use Master Key
       and enter the master key before you click 
      OK
      .
    • Select 
      Push & Commit
      . Panorama pushes the bundle and initiates a commit on the firewall.
    • Click 
      Close
       after the push has committed successfully.
    • Launch the Web Interface of the firewall and ensure that the configuration has been successfully committed. If not, 
      Commit 
      the changes locally on the firewall.
    • Select 
      Commit
      Commit to Panorama
       and 
      Commit
       your changes.
  • Push the device group and template configurations to complete the transition to centralized management.
    This step overwrites any local 
    Network
     and 
    Device
     settings configured on the firewall.
    If you are migrating multiple firewalls, perform all the preceding steps—including this one—for each firewall before continuing.
    • Select 
      Commit
      Commit and Push
       and 
      Edit Selections
       in the Push Scope.
    • Select 
      Device Groups
       and select the device groups that contain the imported firewall configurations.
    • Select 
      Merge with Device Candidate Config
      , 
      Include Device and Network Templates
      , and 
      Force Template Values
      .
    • Click 
      OK
       to save your changes to the Push Scope.
    • Commit and Push
       your changes.
  • On the Panorama web interface, select 
    Panorama
    Managed Devices
    Summary
     and verify that the device group and template stack are in sync for the firewall. On the firewall web interface, verify that configuration objects display a green cog (  ), signifying that the configuration object is pushed from Panorama.
  • Fine-tune the imported configuration.
    • In Panorama, select 
      Panorama
      Config Audit
      , select the 
      Running config
       and 
      Candidate config
       for the comparison, click 
      Go
      , and review the output.
    • Update the device group and template configurations as needed based on the configuration audit and any warnings that Panorama displayed after the import. For example:
  • Consolidate all the imported firewall configurations.
    This step is required if you are migrating multiple firewalls.
    • After importing all the firewall configurations, update the device groups and templates as needed to eliminate redundancy and streamline configuration management: see Fine-tune the imported configuration. (You don’t need to push firewall configuration bundles again.)
    • Configure any firewall-specific settings.
      If the firewalls will have local zones, you must create them before performing a device group or template commit; Panorama can’t poll the firewalls for zone name or zone configuration. If you will use local firewall rules, ensure their names are unique (not duplicated in Panorama). If necessary, you can Override a Template or Template Stack Value with a firewall-specific value.
    • Commit and push your changes:
      • Select 
        Commit
        Commit and Push
         and 
        Edit Selections
         in the Push Scope.
      • Select 
        Device Groups
        , select the device groups you changed, and 
        Include Device and Network Templates
        .
      • Click 
        OK
         to save your changes to the Push Scope.
      • Commit and Push
         your changes.
  • Perform your post-migration test plan.
    Perform the verification tasks that you devised during the migration planning to confirm that the firewalls work as efficiently with the Panorama-pushed configuration as they did with their original local configuration: see Create a post-migration test plan.
 
Mots clés : Palo Alto Networks, Strata Firewall Panorama 10.1.x