(/content/techdocs/en_US.
html)
Updated on Thu Mar 13 [Link] UTC 2025
Home (/) | Panorama (/content/techdocs/en_US/[Link])
| Panorama Administrator's Guide (/content/techdocs/en_US/panorama/10-1/[Link])
| Set Up Panorama (/content/techdocs/en_US/panorama/10-1/panorama-admin/[Link])
| Set Up the M-Series Appliance (/content/techdocs/en_US/panorama/10-1/panorama-admin/set-up-panorama/set-up-the-m-
[Link])
| Configure Panorama to Use Multiple Interfaces (/content/techdocs/en_US/panorama/10-1/panorama-admin/set-up-
panorama/set-up-the-m-series-appliance/[Link])
| Configure Panorama for Network Segmentation (/content/techdocs/en_US/panorama/10-1/panorama-admin/set-up-
panorama/set-up-the-m-series-appliance/configure-panorama-to-use-multiple-interfaces/configure-panorama-for-network-
[Link])
DOWNLOAD PDF (/CONTENT/DAM/TECHDOCS/EN_US/PDF/PANORAMA/10-1/PANORAMA-
ADMIN/[Link])
Panorama Administrator's Guide
(/content/techdocs/en_US/panorama/10-
1/[Link])
Configure Panorama for Network Segmentation
Table of Contents
To offload Panorama services from the MGT interface to other interfaces, start by configuring the interfaces on the
Panorama management server. If your network has heavy log traffic, remember that the Eth4 and Eth5 interfaces on
the M-500 and M-600 appliances support higher throughput (10Gbps) than the other interfaces (1Gbps). Then,
configure the Log Collectors in each subnetwork to connect with specific interfaces on Panorama. For each Log
Collector, you also select an interface for Collector Group communication and one or more interfaces for collecting
logs from firewalls. Finally, configure the firewalls in each subnetwork to connect with interfaces on Panorama.
If you are configuring an M-Series appliance in Log Collector mode with 10GB interfaces, you must com-
plete this entire configuration procedure for the 10GB interfaces to display as Up.
Palo Alto Networks recommends that you specify the IP address, netmask (for IPv4) or prefix length
(for IPv6), and default gateway for the MGT interface. If you omit one of these settings (such as the
default gateway), you can access the M-Series appliance only through the console port for future
configuration changes.
Perform the following steps to configure Panorama and Dedicated Log Collectors to use multiple interfaces:
STEP 1 -
Verify that the Panorama appliances and firewalls support multiple interfaces, and have the prerequisite
software versions and configurations.
The M-Series appliances must run Panorama 8.0 or later to use a separate interface for deploying
updates and to use multiple interfaces for device management and log collection. The M-200 and
M-600 appliances must run Panorama 8.1 or later. Panorama appliances deployed on ESXi, vCloud,
Air, Hyper-V and KVM must run Panorama 8.1 or later.
If you deployed a Panorama or Log Collector as a virtual appliance, verify the Supported Interfaces
for the Panorama Virtual Appliance (/content/techdocs/en_US/panorama/10-1/panorama-
admin/set-up-panorama/set-up-the-panorama-virtual-appliance/setup-prerequisites-for-the-
[Link]#id4430de3f-a44c-4b24-b9c3-52cef1f0bc96_idf4b43812-802f-
44fc-9c26-1af0464695be).
The M-Series appliances must run Panorama 6.1 or later to use separate interfaces for log collection
or Collector Group communication.
The initial configuration of each Panorama ([Link]
1/panorama-admin/set-up-panorama/set-up-the-m-series-appliance/perform-initial-configuration-
of-the-m-series-appliance) management server is complete. This includes configuration of the MGT
interface.
To configure an IPv6 IP address for the Panorama MGT interface, you must configure both
an IPv4 and IPv6 to successfully configure Panorama using an IPv6 IP address. Panorama
does not support configuring the MGT interface with only an IPv6 IP address.
Log Collectors ([Link]
panorama/set-up-the-m-series-appliance/set-up-the-m-series-appliance-as-a-log-collector) and
Collector Groups ([Link]
log-collection/manage-collector-groups/configure-a-collector-group) are configured. This includes
configuration of the MGT interface on the Log Collectors.
To configure an IPv6 IP address for the MGT interface of a Log Collector, you must config-
ure both an IPv4 and IPv6 to successfully configure Panorama using an IPv6 IP address.
Panorama does not support configuring the MGT interface with only an IPv6 IP address.
The initial configuration of the firewalls ([Link]
admin/getting-started/integrate-the-firewall-into-your-management-network/perform-initial-
configuration) is complete, you have added the firewalls to Panorama
([Link]
[Link]) as managed devices, and the firewalls in each subnetwork are
assigned to a separate template ([Link]
admin/manage-firewalls/manage-templates-and-template-stacks/add-a-template).
The initial configuration of WildFire appliances is complete and you have added WildFire appliances
to Panorama ([Link]
wildfire-appliances/manage-wildfire-clusters/configure-a-cluster-centrally-on-panorama/configure-
[Link]) as managed devices.
STEP 2 -
Configure the interfaces on the solitary (non-HA) or active (HA) Panorama management server.
Because the MGT interface was configured during initial Panorama configuration, you don’t
have to configure it again.
Perform these steps for each interface:
A Log in to the Panorama Web Interface (/content/techdocs/en_US/panorama/10-1/panorama-
admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-
[Link]#id60bb9ed6-4859-441a-8c86-f2a81f2cb38e) of the solitary (non-
HA) or active (HA) Panorama management server.
B Select Panorama > Setup > Interfaces.
C Click an Interface Name to edit the interface.
D Select <interface-name> to enable the interface.
E Configure one or both of these field sets based on the IP protocols of your network:
IPv4—IP Address, Netmask, and Default Gateway
IPv6—IPv6 Address/Prefix Length and Default IPv6 Gateway
F Select the services that the interface supports:
Device Management and Device Log Collection—Manage firewalls, Log Collectors, and WildFire
appliances and appliance clusters, collect logs that the Log Collectors generate, and query the
Log Collectors for report information. To support a segmented network, you can enable these
services on multiple interfaces.
Collector Group Communication—Communicate with the Collector Groups that Panorama
manages across all subnetworks.
Device Deployment—Deploy software and content updates to managed firewalls, Log
Collectors, and WildFire appliances and appliance clusters across all subnetworks.
G Click OK to save your changes to the interface.
H Click Commit > Commit to Panorama and Commit your changes.
I Click Commit > Push to Devices and push the changes to the Collector Group that contain the Log
Collectors you modified.
STEP 3 -
( HA only ) Configure the interfaces on the passive Panorama management server.
A Log in to the Panorama Web Interface (/content/techdocs/en_US/panorama/10-1/panorama-
admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-
[Link]#id60bb9ed6-4859-441a-8c86-f2a81f2cb38e) of the active
Panorama management server.
B Select Panorama > Managed Collectors and select the passive HA peer.
C Select Interfaces and click an interface to edit.
D Check the Enable Interface box to enable the interface.
E Configure one or both of these field sets based on the IP protocols of your network:
IPv4—IP Address, Netmask, and Default Gateway
IPv6—IPv6 Address/Prefix Length and Default IPv6 Gateway
F Select the services that the interface supports:
Device Management and Device Log Collection—Manage firewalls, Log Collectors, and WildFire
appliances and appliance clusters, collect logs that the Log Collectors generate, and query the
Log Collectors for report information. To support a segmented network, you can enable these
services on multiple interfaces.
Collector Group Communication—Communicate with the Collector Groups that Panorama
manages across all subnetworks.
Device Deployment—Deploy software and content updates to managed firewalls, Log
Collectors, and WildFire appliances and appliance clusters across all subnetworks.
G Click OK to save your changes to the interface.
H Select Commit > Commit and Push to commit your changes to Panorama and to push the changes
to Collector Groups that contain the passive HA peer you modified.
STEP 4 -
Configure each Log Collector to connect with a Panorama interface.
To support a segmented network, you can connect the Log Collectors in each subnetwork to separate
Panorama interfaces. The interfaces must have Device Management and Device Log Collection
enabled, as described in the previous step.
A Log in to the Panorama Web Interface (/content/techdocs/en_US/panorama/10-1/panorama-
admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-
[Link]#id60bb9ed6-4859-441a-8c86-f2a81f2cb38e) of the solitary (non-
HA) or active (HA) Panorama management server.
B Select Panorama > Managed Collectors and edit the Log Collector.
C In the Panorama Server IP field, enter the IP address of an interface on the solitary (non-HA) or
active (HA) Panorama.
D ( HA only ) In the Panorama Server IP 2 field, enter the IP address of an interface on the passive
Panorama that will support Device Management and Device Log Collection if failover occurs on the
active Panorama.
E Click OK to save your changes.
F Select Commit > Commit and Push to commit your changes to Panorama and to push the changes
to Collector Groups that contain the Log Collector you modified.
G Perform the following steps on each Dedicated Log Collector:
1. Access the Log Collector CLI by using emulation software such as PuTTY to open a SSH session
to the Log Collector using its MGT interface IP address. When prompted, log in using Panorama
administrator credentials.
2. Run the following commands, where <IPaddress1> is for the solitary (non-HA) or active (HA)
Panorama and <IPaddress2> is for the passive Panorama (if applicable).
> configure
# set deviceconfig system panorama-server <IPaddress1> panorama-server-2 <IPaddre
ss2>
# commit
STEP 5 -
( HA only ) Configure an interface on the passive Panorama management server to deploy updates in
case the active Panorama fails over.
A Log in to the Panorama Web Interface (/content/techdocs/en_US/panorama/10-1/panorama-
admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-
[Link]#id60bb9ed6-4859-441a-8c86-f2a81f2cb38e) of the passive
Panorama management server.
B Select Panorama > Setup > Interfaces.
C Click an Interface Name to edit the interface.
D Select <interface-name> to enable the interface.
E Configure one or both of these field sets based on the IP protocols of your network:
IPv4—IP Address, Netmask, and Default Gateway
IPv6—IPv6 Address/Prefix Length and Default IPv6 Gateway
F Select Device Deployment.
G Click OK to save your changes.
H Click Commit > Commit to Panorama and Commit your changes.
STEP 6 -
Configure the interfaces that the Log Collectors will use to collect logs from firewalls and communicate
with other Log Collectors.
Because the MGT interface was configured during initial configuration of the Log Collectors,
you don’t have to configure it again.
A Log in to the Panorama Web Interface (/content/techdocs/en_US/panorama/10-1/panorama-
admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-
[Link]#id60bb9ed6-4859-441a-8c86-f2a81f2cb38e) of the solitary (non-
HA) or active (HA) Panorama management server.
B Select Panorama > Managed Collectors and edit the Log Collector.
C Select Interfaces and perform the following steps for each interface:
1. Click an interface name to edit that interface.
2. Select <interface-name> to enable the interface.
3. Configure one or both of the following field sets based on the IP protocols of your network.
IPv4—IP Address, Netmask, and Default Gateway
IPv6—IPv6 Address/Prefix Length and Default IPv6 Gateway
4. Select the functions that the interface supports:
Device Log Collection—Collect logs from firewalls. You can load balance the logging traffic by
enabling multiple interfaces to perform this function.
Collector Group Communication—Communicate with other Log Collectors in the Collector
Group.
5. Click OK to save your changes to the interface.
D Click OK to save your changes to the Log Collector.
E Select Commit > Commit and Push to commit your changes to Panorama and to push the changes
to Collector Groups that contain the Log Collectors you modified.
F Select Panorama > Managed Collectors to verify that the Log Collectors are synchronized and
connected with Panorama.
The Configuration Status column should display InSync and the Run Time Status column should
display connected.
STEP 7 -
Configure the firewalls to connect with a Panorama interface.
To support a segmented network, you can connect the firewalls in each subnetwork to separate
Panorama interfaces. The interfaces must have Device Management and Device Log Collection
enabled. This step assumes that you use separate templates to configure the firewalls in separate
subnetworks.
In this example deployment, Panorama uses these interfaces to manage the firewalls but not
to collect firewall logs. You specify which Dedicated Log Collectors will collect firewall logs
when you configure Collector Groups ([Link]
1/panorama-admin/manage-log-collection/manage-collector-groups/configure-a-collector-
group).
A Log in to the Panorama Web Interface (/content/techdocs/en_US/panorama/10-1/panorama-
admin/set-up-panorama/access-and-navigate-panorama-management-interfaces/log-in-to-the-
[Link]#id60bb9ed6-4859-441a-8c86-f2a81f2cb38e) of the solitary (non-
HA) or active (HA) Panorama management server.
B On Panorama, select Device > Setup > Management, select a Template and edit the Panorama
Settings.
C In the first Panorama Servers field, enter the IP address of an interface on the solitary (non-HA) or
active (HA) Panorama.
D ( HA only ) In the second Panorama Servers field, enter the IP address of an interface on the
passive Panorama that will support device management if failover occurs.
E Click OK to save your changes.
F Select Commit > Commit and Push to commit your changes to Panorama and push the template
changes to firewalls.
G Select Panorama > Managed Devices to verify that the firewalls are synchronized and connected
with Panorama.
The Device State column should display Connected. The Shared Policy and Template columns should
display InSync.
Previous Next
(/content/techdocs/en_US/panorama/10-
Multiple 1/panorama-admin/set-up-panorama/set-Register (/content/techdocs/en_US/panorama/10-
Interfaces for up-the-m-series-appliance/configure- Panorama 1/panorama-admin/set-up-
Network panorama-to-use-multiple- and panorama/register-panorama-and-install-
Segmentation interfaces/multiple-interfaces-for- Install [Link])
Example [Link]) Licenses
([Link] (h
([Link]
(/content/techdocs/en_US.html) © 2025 Pa
