Zero Touch Provisioning (ZTP) for Palo Alto Networks Firewalls

Overview

Zero Touch Provisioning (ZTP) is a provisioning mechanism that allows unconfigured devices to automatically load deployment files upon power-on, including system software, patches, and configuration files. This eliminates the need for onsite, manual configuration and deployment, reducing labor costs and improving deployment efficiency.

Benefits of ZTP

• Automated Deployment: Devices can be shipped directly to their deployment locations and automatically configured upon connection to the network.
• Reduced Manual Intervention: Minimizes the need for technical staff to be present at each deployment site.
• Consistency: Ensures uniform configuration across all devices, reducing the risk of human error.
• Scalability: Facilitates the rapid deployment of devices across multiple locations.

How ZTP Works

1. Upon power-on, the device obtains an IP address via DHCP.
2. The device contacts the Palo Alto Networks ZTP service using preconfigured settings.
3. The ZTP service authenticates the device using its serial number and claim key.
4. Once authenticated, the device downloads the necessary configuration files and software updates.
5. The device applies the configurations and connects to the Panorama management server for centralized management.

Implementing ZTP with Panorama

To set up ZTP with Panorama:

1. Ensure a DHCP server is available on the network to provide IP addresses to new devices.
2. Register the device's serial number and claim key in the Palo Alto Networks Customer Support Portal.
3. In Panorama, add the device using its serial number and claim key.
4. Assign the device to the appropriate device group and template stack.
5. Power on the device and connect it to the network; it will automatically retrieve its configuration and connect to Panorama.

Note: Devices onboarded using ZTP cannot be configured in a High Availability (HA) setup until ZTP is disabled on the device.

Best Practices

• Use ZTP for large-scale deployments to reduce manual configuration efforts.
• Ensure that the DHCP server is properly configured to provide necessary network information to new devices.
• Verify that the device's serial number and claim key are correctly registered in the Customer Support Portal.
• After ZTP onboarding, if needed, reassign the device to the appropriate device group and template stack in Panorama.
• Disable ZTP on the device before configuring HA setups.

References

• What Is Zero Touch Provisioning (ZTP)? - Palo Alto Networks
• Set Up Zero Touch Provisioning - Palo Alto Networks
• Add a ZTP Firewall to Panorama - Palo Alto Networks
• Zero Touch Provisioning (ZTP) Onboarding Enhancements - Palo Alto Networks