PAN-OS: Panorama Configuration Backups

PCNSE Objective Focus (Domain 4 - 18%)

4.3 Manage firewall configurations within Panorama

• (Related Concept) Backup and Restore Operations

Introduction: Importance of Backups

Regularly backing up the configuration of your Panorama management server is a critical operational task. Panorama holds the centralized policies, objects, templates, and device management settings for your entire fleet of managed firewalls. Losing the Panorama configuration without a backup could be catastrophic, requiring extensive effort to rebuild policies and configurations.

Configuration backups provide a safety net, enabling you to:

• Recover from Hardware Failures: Restore the configuration onto replacement Panorama hardware (physical appliance or VM).
• Recover from Software Issues: Revert to a known-good state if a Panorama software upgrade or major configuration change causes unexpected problems.
• Disaster Recovery: Restore the Panorama configuration at a DR site.
• Testing/Validation: Create backups before implementing major changes, allowing for easy rollback if needed.
• Auditing/Compliance: Maintain historical records of configurations.

Panorama manages configurations in layers, and backups reflect this:

• Configuration Snapshots: These are point-in-time copies of the Panorama configuration state. You can save snapshots of:
  • Running Configuration: Captures the currently active configuration on Panorama. This is the most common type to back up for recovery.
  • Candidate Configuration: Captures the configuration currently being edited (before a commit). Useful for saving work-in-progress or specific candidate states before merging other changes.
• Configuration Bundle: This is not a direct backup file but rather the set of configurations (merged from Shared, Device Groups, Templates) that Panorama *pushes* to a managed firewall during a commit. You can export the configuration *as pushed* to a specific device group or firewall for analysis, but restoring Panorama itself uses configuration snapshots.
• Device State Backup (on Firewall): Managed firewalls also maintain their own local configuration snapshots. While useful for local recovery, they don't contain the Panorama-specific management configurations (Device Groups, Templates, etc.). Restoring Panorama requires a Panorama snapshot.

For recovering the Panorama management server itself, you primarily work with Running Configuration Snapshots taken on Panorama.

1. Manual Backup (Export Configuration):

   • Location: Panorama > Setup > Operations > Save/Load section (or similar path depending on version).
   • Action:
     • Click `Save named configuration snapshot` to save the current *candidate* config with a custom name on Panorama's local disk.
     • Click `Save configuration snapshot` to save the current *running* config with a timestamped name on Panorama's local disk.
     • Click `Export named configuration snapshot` to select a previously saved snapshot (running or candidate) and download it as an XML file to your local computer.
     • Click `Export configuration version` to select a specific committed version (by sequence number) and download it.
   • Pros: Simple, direct control, allows storing backups off-box.
   • Cons: Relies on administrator remembering to perform backups, backups stored locally on admin workstation might not be centrally managed or secured.

2. Scheduled Configuration Export (Recommended):

   • Location: Panorama > Scheduled Config Export
   • Action: Configure scheduled tasks to automatically export Panorama's running configuration snapshot to a remote server.
   • Key Settings:
     • Name: Name for the schedule.
     • Location: Select the target Device Group (usually `shared` or a specific DG if configuration segmentation is used, though typically backups cover the whole Panorama config).
     • Protocol: SCP or FTP . (SCP is preferred for security).
     • Server Address: IP or FQDN of the remote SCP/FTP server.
     • Port: Server port (e.g., 22 for SCP).
     • Path: Directory path on the remote server where backups should be stored.
     • Username/Password or Key: Credentials for accessing the remote server.
     • Schedule: Define recurrence (e.g., Daily, Weekly) and time.
   • Pros: Automated and reliable , ensures regular backups are taken, stores backups off-box on a secure server. This is the recommended method for production environments.
   • Cons: Requires setting up a secure external SCP/FTP server and managing credentials.

3. Tech Support File:

   • Location: Panorama > Support
   • Action: Generate and download a Tech Support File (TSF).
   • Content: Includes the running configuration, logs, system state, and diagnostic information.
   • Use Case: Primarily for troubleshooting with Palo Alto Networks support, but the configuration *is* contained within it.
   • Pros: Contains extensive diagnostic data along with config.
   • Cons: Very large file size, not intended as a primary backup method, restoring *only* the config from a TSF is less straightforward than using a configuration snapshot.

Caveats and Gotchas

For the PCNSE exam, understand:

• The importance of backing up the Panorama configuration.
• The difference between running and candidate configuration snapshots.
• The methods for creating backups: Manual Export and Scheduled Configuration Export .
• The recommended best practice: Scheduled exports to an external SCP/FTP server .
• Where to configure manual exports (`Panorama > Setup > Operations`).
• Where to configure scheduled exports (`Panorama > Scheduled Config Export`).
• The key parameters needed for scheduled exports (Protocol, Server, Path, Credentials, Schedule).
• The necessity of storing backups externally (off-box) .
• The general limitation of restoring snapshots primarily to the same PAN-OS version .
• What is typically included (Panorama config) vs. excluded (logs, firewall runtime data) in a configuration snapshot.

References

• Panorama Admin Guide: Save and Export Panorama Configurations
• Panorama Admin Guide: Schedule Configuration Exports to an External Server
• Panorama Admin Guide: Revert Panorama Configuration Changes
• Knowledge Base: Best Practices for Backup and Restore of Panorama
• Palo Alto Networks Certified Network Security Engineer (PCNSE) Exam Blueprint (Domain 4)