• 1. Palo Alto Networks Professional Service Flex Licensing Migration Lab
  • 1.1 Overview
  • 1.2 Covered Secaniros
• 2 Deploy Panorama in Microsoft Azure
  • 2.1 Deploy Azure Resource Group
  • 2.2 Deploy Panorama in Azure
• 3. Customer Support Portal
  • 3.1 Login To Customer Support Portal
  • 3.2 Create Fixed Deployment Profiles
    • 3.2.1 Azure Deployment Profile
  • 3.3 License Panorama
    • 3.3.1 Provision Panorama Serialnumber
    • 3.3.2 Configure Panorama
      • 3.3.2.1 License Panorama
      • 3.3.2.2 Create Device Group and Device Template
      • 3.3.2.3 Base config of the Device Template
• 4. Deploy Firewalls in Azure
  • 4.1 What you will do?
  • 4.2 Deployment
  • 4.3 Validate Deployment
• 5 License Migration
  • 5.1 Covered Secanrios in Detail
  • 5.2 Migrate Software Firewalls
    • 5.2.1 Initial Migration
    • 5.2.2 Migrate PanOS 10.0.9 to Flexible Deployment Profile
    • 5.2.3 Migrate PanOS 10.2.3 to Flexible Deployment Profile
  • 5.3 Change vCPU on PanOS 10.2.3 Firewall
  • 5.4 Change/Update Deployment Profiles
    • 5.4.1 Add Security Subscriptions
    • 5.4.2 Remove Security Subscriptions
• 6 Lab Clean Up
  • 6.1 Remove Firewall Ressource Group
  • 6.2 Remove Panorama Ressource Group
  • 6.3 Remove Deployment Profiles

1. Palo Alto Networks Professional Service Flex Licensing Migration Lab

1.1 Overview

The Following Lab guide will help you to understand how to migrate Non-Flex licensed Software Firewalls from Non-Flex license model (ELA, etc) to the new Flex License Model. It will also cover how to create Deployment profiles in the Customer Suport Portal (CSP) to cover several secanrios. The Lab will only cover Migration use cases as listed below 1. Standalone Firewall with Access to the CSP 2. Standalone Firewall, No Access to the CSP 3. Panorama-Managed Firewalls with Access to the CSP 4. Panorama-Managed Firewalls, No Access to the CSP

Private Cloud and other Public Cloud Providers will not be covered in the Lab. The deployed firewall are running in PanOS 9.1, 10.0.3, 10.2

1.2 Covered Secaniros

The following Secanrios and Lab activies are covered

1. Deploy a new Lab Panorama to fullfill the Migration process
2. Configure Panorama to perform the Lab activities
3. Setup the Customer support Portal (CSP)
   1. Creating several Deployment Profiles
4. Deploy Software Firewalls and License them with an ELA License
   1. 2 Firewalls in PanOS 9.1.13-h3
   2. 2 Firewalls in PanOS 10.0.9
   3. 2 Firewalls in PanOS 10.2.3
5. Migrate Software Firewalls from NON-Flex License Model to Flex-License Model
   1. NON-Flex to Flex-License (Fixed Deployment Profile)
   2. Flex-License to Flex-License (Flexible Deployment Profile)
6. How to update the Deployment Profile
   1. Enable/Disable CDSS
   2. Increase/Decrease vCPU count
7. Troubleshooting

2 Deploy Panorama in Microsoft Azure

For this workshop you will create a first a Panorama before we deploy the Software Firewall in other Public Cloud Providers. The Panorama will have direct internet access. the Panorama is not connected to any other internal Ressource in Azure.

2.1 Deploy Azure Resource Group

1. Login in to Azure Portal (https://portal.azure.com). As Login use your Palo Alto Networks Credentials
2. Open Azure Cloud Shell
3. In Cloud Shell execute the following command but change before the values [StudentRGName] and [Location] Available Regions are: North Europe, East US, UK South, UAE North, Australia Central

   az group create --name [StudentRGName] --location [Location] --tags Owner=Workshop-DeleteMe
   

4. The Output should looks like the following

2.2 Deploy Panorama in Azure

As next we will create the Panorama from a pre-staged image, after successfully creating the Resource Group.

1. Please go back to the Azure Cloud Shell
2. In the following command updat the following variables with yours:
   1. [StudentRGName] #Use the same same of the previous created Resource Group in the Chapter Deploy new Resource Group in Azure
   2. [VM-Name]
   3. [YourPassword]

Don't change any other variables

az vm create -g [StudentRGName] -n [VM-Name] --authentication-type password --admin-password [YourPassword] --image /subscriptions/d47f1af8-9795-4e86-bbce-da72cfd0f8ec/resourceGroups/ImageRG/providers/Microsoft.Compute/galleries/PsLab/images/psazurelab/versions/1.0.0 --specialized --public-ip-sku Standard  --plan-name byol --plan-publisher paloaltonetworks --plan-product panorama --size Standard_D4_v2

4. After you made the changes, execute the command in Azure Cloud Shell
5. The Output should looks like the following
6. Check your Ressource Group in Aure if the Deployment is completed
7. In the Ressource Group select your NSG
8. Now create an Inbound Security Rule to allow any traffic to your newly created Panorama
9. Login to your Panorama via the Public IP associated to it. The Instructor will provide you the Usernam and Password.
   1. https://[Public-IP]

Congratulations!! You have succesfully deploye a Panorama in Microsoft Azure.

3. Customer Support Portal

In the following Lab section we will go to the Customer support portal (CSP) to create your first Deployment Profiles. This is needed for the intial Migration and generating a Serialnumber for the Panorama

3.1 Login To Customer Support Portal

1. Login with your PANW Credentials at the Customer Support Portal https://support.paloaltonetworks.com/
2. In the Support Portal Change the Account Seletor to 132205 - Palo Alto Networks - Professional Services
3. On the Support Portal Page on the left side go to Assets -> Software NGFW Credits

3.2 Create Fixed Deployment Profiles

Now you will create one Deployment Profile in the Customer Support Portal.

3.2.1 Azure Deployment Profile

1. On the Prisma NFGW Credits Pool click on Create Deployment Profile
2. Select the following as shown on the picture below and click Next
3. In the Deployment Profile use the following and replace Instructor-Lab under "Profile Name" with "Migration-Lab-Fixed-[StudentName]"
4. Click "Create Deployment Profile"
5. Verify that your Deployment Profile is successfully created

3.3 License Panorama

In the next steps you will create a Serialnumber for your previous created Panorama with the Flex License Credits

3.3.1 Provision Panorama Serialnumber

1. Login with your PANW Credentials at the Customer Support Portal https://support.paloaltonetworks.com/
2. On the Support Portal Page on the left side go to Assets -> Software NGFW Credits -> Details
3. Now Search for your previous created Azure Deployment Profile here
4. Click on the 3 dots and on Provision Panorama
5. In the new window click on Provision
6. Once the window is closed repeat the steps from step 3
7. Now you can see a Serialnumber in the Window. Copy and Paste the Serialnumber
8. You can close the window by clicking Cancel

3.3.2 Configure Panorama

As next we will License your Panorama with the Serialnumber you created above and create a new Decive Group and Template inside your new Panorama and do some basic configuration in your Device Template

3.3.2.1 License Panorama

1. Login to your Panorama https://[Public-IP]
2. Copy the the Serialnummber you create on the CSP Portal and enter it under the Panorama Tab -> Setup -> Management -> General Settings
3. Hit OK and reload the UI. Check if a pending commit on the Panorama is needed. If yes, commit to Panorama.
4. In the Panorama check if you can see a Serialnummber is associated to it

3.3.2.2 Create Device Group and Device Template

1. As next Create a Device Group, Template, and Template Stack. See the picture below as example
2. Once you done it commit your changes to the Panorama

3.3.2.3 Base config of the Device Template

1. In the Panorama navigate to Device and select under Template your previous create Template (my example Stundent-TP)
2. In your Template click on Select -> Service and click on the wheel.
3. In the Services tab type 8.8.8.8 under Primary DNS Server
4. As next click on the NTP tab and provide an NTP server from your region (my example 0.de.pool.ntp.org)
5. Click Ok once you entert it
6. As next click on the left panel on Dynamic Updates
7. Change the settings as shown in the picture below
8. At the end commit your changes to the Panorama

4. Deploy Firewalls in Azure

In the following chapter you will deploy several Software Firewalls in different PanOS version. The Software Firewalls will automatically join your previous created Panorama

4.1 What you will do?

• Login to Azure Portal (https://portal.azure.com) and login with your Credentials
• Download Terraform Code from GitHub
• Modify Terraform Code
• Execute Terraform Code
• Validate Deployment in Azure Portal and Panorama

4.2 Deployment

1. Login in to Azure Portal (https://portal.azure.com)

2. Open Azure Cloud Shell

3. click on Create storage. In some case it will not create a Storage Account. In that case click in "Show advanced settings" and create your own storage account.

4. Once the creation of the storage is completed you will see the following

5. Download Terraform Code from GitHub

   1. in the Cloud shell execute the following command

      git clone https://github.com/PaloAltoNetworks/flex-license-migration-lab.git
      

   2. As output you will see the following

6. Now browse to the deployment folder folder

   cd cd flex-license-migration-lab/azure/single\ firewall\ deployment/
   

7. Rename the terraform.tfvars.example to terraform.tfvars mv ./example.tfvars terraform.tfvars

   **Command:**
   ``` mv ./terraform.tfvars.example terraform.tfvars```
   

8. Modify the terraform.tfvars inside Cloud shell with the vi command

   1. Modify the following variables in the File.

   resource_group_name     = "migration-[Studenname]" #replace [Studentname] with your Name
   password                = "SecurePassWord12!!" #change the password. Use a complex password
   storage_account_name    = "pantfstorage[Studenname]" #replace [Studentname] with your name in small letters without space
   storage_share_name      = "bootstrapshare[Studenname]" #replace [Studentname] with your name in small letters without space
   
   

9. Save your changes by pressing ESC and type :wq! and ENTER

10. As next switch to the folder files and rename the init-cfg.sample.txt to init-cfg.txt using the mv command

11. Modify the init-cfg.txt inside Cloud shell with the vi command. Make sure you added the same name of the Device Group and Template Stack you created in your Panorama. The value for the varibles tplname and dgname can be found in the section 3.3.2 License Panorama / Create Device Group and Template

     type=dhcp-client
     vm-auth-key=123456789012345   #Follow the fLink below to create/show the key
     panorama-server=10.1.2.3      #change it to the Public IP of your Panorama
     tplname=my-stack              #change it to the Template Stack inside your Panorama Section [3.3.2]
     dgname=my-device-group        #change it to the Device Group inside your Panorama Section [3.3.2]
     dhcp-send-hostname=yes
     dhcp-send-client-id=yes
     dhcp-accept-server-hostname=yes
     dhcp-accept-server-domain=yes
    

    LINK to Guide for the Key creation

12. As next in folder files and rename the authcodes.sample to authcodes using the mv command

13. Modify the authcodes files with the vi command.

    XXXXXXX # Instructor will provide you the Key via Slack
    

14. Save your changes by pressing ESC and type :wq! and ENTER

15. Move back to the single\ firewall\ deployment folder with the command cd..

16. Once you made all your changes execute the Terraform code with following commands:

    1. terraform init.
    2. terraform plan.
    3. terraform apply once you get the prompet type yes

17. Important! The complete deployment will take up to 10 Minutes after the completing the Terraform Apply. It is a good time for a break

18. Terraform Init

19. Terraform Plan

20. Terraform Apply

21. Once the terraform apply is completed you will see the following output

4.3 Validate Deployment

• Login into Panorama
• Validate Deployment

1. Login into Panorama Public IP
2. Once you logged into the Panorama Navigate to the Panorama tab validate you can see your newly deployed Firewalls (The deployment and bootstrapping process can take up to 10-15 minutes). If the Deployment was succesful you will see the following output in Panorama -> Managed Devices -> Summary

3. You succesfull deployed your Environment if you can see the above output

Congratulations you succesfully deployed several VM-Series Firewalls in different PanOS Version and bootstrapped them.

5 License Migration

In the following steps you will migrate the previous created from a NON-Flex License model to the Flex-License model. You will do several migrations and create/update some Deployment profiles to fulfill the activities.

5.1 Covered Secanrios in Detail

1. Migrate all Software Firewall to Flex License model (Fixed Deployment Profile) via Panorama
2. Migrate one (1) Firewall with PanOS 9.1.13-h3 to Fixed License via Panorama
3. Migrate one (1) Firewall with PanOS 10.0.9 to Fixed License via Panorama
4. Migrate one (1) Firewall with PanOS 10.0.9 from Fixed License to Flex via Panorama
5. Migrate one (1) Firewall with PanOS 10.2.3 to Fixed License via Panorama
6. Migrate one (1) Firewall with PanOS 10.2.3 from Fixed License to Flex via Panorama
7. Migrate one (1) Firewall with PanOS 10.2.3 from Flex to Flex with increasing the vCPU via Panorama

5.2 Migrate Software Firewalls

In the following section we will migrate now all Software Firewall from the NON-Flex license model to the Flex license model. For that we will use the Deployment profile fou created in the section 3.2 Create Fixed Deployment Profiles.

5.2.1 Initial Migration

In the following section you migrate all Software Firewalls from NON-Flex Licensing to Flex Licensing.

1. Login with your PANW Credentials at the Customer Support Portal https://support.paloaltonetworks.com/
2. In the Support Portal Change the Account Seletor to 132205 - Palo Alto Networks - Professional Services
3. On the Support Portal Page on the left side go to Assets -> Software NGFW Credits -> Details
4. Now Search for your previous created Azure Deployment Profile Here
5. Now Copy the Auth Code of your Profile.
6. As next Login in to your Panorama https://[Public-IP]
7. In Your Panorama navigate to Panorama -> Device Deployment -> Licenses
8. In the License window click at the bottom Activate
9. In the opened Window select now all available Firewalls and type in AUTH CODE field the auth code and click Activate
10. The Migration process will now take several minutes.
11. Once Migration is completed you will see the following outcome
12. As next check on the CSP if your credits got consumed from your deployment profile. You should see the below outcome

Congratulations!!! You Migrated successful all your Software Firewalls from a NON-Flex license model to Flex License model (Fixed Deployment Profile) via Panorama

5.2.2 Migrate PanOS 10.0.9 to Flexible Deployment Profile

In the following section we will create a new Deployment Profile to migrate the Software Firewalls from a Fixed Deployment Profile to a Flexible Deployment Profile

1. Login with your PANW Credentials at the Customer Support Portal https://support.paloaltonetworks.com/
2. In the Support Portal Change the Account Seletor to 132205 - Palo Alto Networks - Professional Services
3. On the Support Portal Page on the left side go to Assets -> Software NGFW Credits
4. On the Prisma NFGW Credits Pool click on Create Deployment Profile
5. Select the following as shown on the picture below and click Next
6. In the Deployment Profile use the following and use the NAME under "Profile Name" with "Migration-Lab-Flex-[StudentName]"
7. Click "Create Deployment Profile"
8. Verify that your Deployment Profile is successfully created
9. Now Copy the Auth Code of the newly created Deployment Profile
10. As next Login in to your Panorama https://[Public-IP]
11. In Your Panorama navigate to Panorama -> Device Deployment -> Licenses
12. In the License window click at the bottom Activate
13. Select now Firewall 3 and 4 or as in shown in the Picture the firewalls with the name "PA-VM". You can verify the Name of the firewalls in the Summary tab. Now type in AUTH CODE field the auth code and click Activate
14. Are the upgrade is working? If no, Why?

</details>

15. Before you can perform the License Key upgrade you have to install on the Software Firewalls the License API Key. Follow the instructions to perform the task. Repeat that
16. Install API License Key on ALL other Software Firewalls (1-6) too for future tasks
17. Once you added the API go in your Panorama and switch the context to Firewall 3 or 4 (or PA-VM)
18. In the Firewall navigate Device -> License and click on Upgrade VM capacity
19. In the window add under Authorization Code your atuh code and click Continue
20. You will see the below outcome once it completed. Click close and refresh the UI
21. In the Firewall switch to the Dashboard and you can see the VM License changed to VM-FLEX-4
22. Repeat the same steps for the second firewall.
23. When you know go to the Support Portal and check your profiles, you can see that the count of the Fixed prile is reduced by 2 firewalls and 8 vcpus and the Flex profile increased.

Congratulations!!! You successful migrated 2 Firewalls from a Fixed License Deployment Profile to an Flexible Deployment profile and implemented the API License Key on the Firewalls

5.2.3 Migrate PanOS 10.2.3 to Flexible Deployment Profile

In the following section we will create a new Deployment Profile to migrate the Software Firewalls from a Fixed Deployment Profile to a Flexible Deployment Profile

1. Login with your PANW Credentials at the Customer Support Portal https://support.paloaltonetworks.com/
2. In the Support Portal Change the Account Seletor to 132205 - Palo Alto Networks - Professional Services
3. On the Support Portal Page on the left side go to Assets -> Software NGFW Credits
4. On the Prisma NFGW Credits Pool click on Create Deployment Profile
5. Select the following as shown on the picture below and click Next
6. In the Deployment Profile use the following and use the NAME under "Profile Name" with "Migration-Lab-Flex-10.2-[StudentName]"
7. Click "Create Deployment Profile"
8. Verify that your Deployment Profile is successfully created
9. Now Copy the Auth Code of the newly created Deployment Profile
10. As next Login in to your Panorama https://[Public-IP]
11. In Your Panorama navigate to Panorama -> Device Deployment -> Licenses
12. In the License window click at the bottom Activate
13. Select now Firewall 5 and 6 or as in shown in the Picture. You can verify the Name of the firewalls in the Summary tab. Now type in AUTH CODE field the auth code and click Activate
14. It will fail too because of the same issue you already faced above. Please follow the same instructions from the previous chapter to migrate the firewalls to Flexible Deployment profile.

5.3 Change vCPU on PanOS 10.2.3 Firewall

In the following section we will create a new Deployment Profile to change the vCPU on the already licensed Software Firewall

1. Login with your PANW Credentials at the Customer Support Portal https://support.paloaltonetworks.com/

2. In the Support Portal Change the Account Seletor to 132205 - Palo Alto Networks - Professional Services

3. On the Support Portal Page on the left side go to Assets -> Software NGFW Credits

4. On the Prisma NFGW Credits Pool click on Create Deployment Profile

5. Select the following as shown on the picture below and click Next

6. In the Deployment Profile use the following and use the NAME under "Profile Name" with "Migration-Lab-Flex-10.2-3vcpu-[StudentName]"

7. Click "Create Deployment Profile"

8. Verify that your Deployment Profile is successfully created

9. Verify at first that both software Firewalls (5 and 6) are migrated to the new Flexible Deployment Profile. Check the Firewall Dashboard if you can see (VM-Series-4)

10. As next login to Firewall 5 or 6 via ssh. In my Example i migrate Firewall 6 ssh -oHostKeyAlgorithms=+ssh-rsa USERNAME@FIREWALL IP

11. In the CLI type the following command to set the Core value to 3 request plugins vm_series set-cores cores 3

12. The requires a reboot. Type the following command to rebbot the Firewall request restart system

13. The Reboot of the firewall will take now around ~ 5 Minutes

14. Once the Firewall is back online and function login to the Firewall via Panorama or directly to the Firewall

15. In the Firewall navigate Device -> License and click on Upgrade VM capacity

16. In the window add under Authorization Code your auth code (3 vCPU) and click Continue

17. You will see the below outcome once it completed. Click close and refresh the UI

18. In the Firewall go to the Dashboard and you can see the VM License changed to VM-FLEX-3

Congratulations!!! You successful migrated 1 Software Firewalls from Flexible Deployment Profile with 4 vCPU's to a Flexible Deployment Profile and changed the Cores count via CLI

5.4 Change/Update Deployment Profiles

In the following section you will now update your Deployment Profile ("Migration-Lab-Flex-10.2-[StudentName]") too remove some Subscription and enable subscriptions

5.4.1 Add Security Subscriptions

1. Login with your PANW Credentials at the Customer Support Portal https://support.paloaltonetworks.com/

2. In the Support Portal Change the Account Seletor to 132205 - Palo Alto Networks - Professional Services

3. On the Support Portal Page on the left side go to Assets -> Software NGFW Credits

4. Go to youe Deployment Profile "Migration-Lab-Flex-10.2-[StudentName]" click in the three dots and Edit Profile

5. In your Deployment Profile select the Global Protect and Click Update Deployment Profile

6. Click YES in the new Window

7. As next Login to your Panorama

8. In Your Panorama navigate to Panorama -> Device Deployment -> Licenses

9. Select Refresh

10. Now Select the firewall who was associated with the Auth Code of the "Migration-Lab-Flex-10.2-[StudentName]" Deployment Profile (In the Example is it Firewall 5) and click Refresh

11. You should see the following output if it was successfull

12. Refresh the Panorama UI

13. Now you should see that on Software Firewall 5 is the Global Protect License Active

Congratulations!!! You successful Updated your Deployment Profile and added another Security subscription

5.4.2 Remove Security Subscriptions

1. Login with your PANW Credentials at the Customer Support Portal https://support.paloaltonetworks.com/

2. In the Support Portal Change the Account Seletor to 132205 - Palo Alto Networks - Professional Services

3. On the Support Portal Page on the left side go to Assets -> Software NGFW Credits

4. Go to youe Deployment Profile "Migration-Lab-Flex-10.2-3vcpu-[StudentName]" click in the three dots and Edit Profile

5. In your Deployment Profile de-select the DNSt and Click Update Deployment Profile

6. Click YES in the new Window

7. As next Login to your Panorama

8. In Your Panorama navigate to Panorama -> Device Deployment -> Licenses

9. Select Refresh

10. Now Select the Firewall who is associated with the Update Auth Code.

11. Are the Update working?

12. If everything Worked you have to refresh the UI. In some cases it will show you an error but when you check the Panorama you can see the DNS license got removed or is listed as expired

Congratulations!!! You successful Updated your Deployment Profile and removed a Security subscription

6 Lab Clean Up

In the following Section you will Clean UP your Lab environment. This includes the removing ot the Azure Ressource Group (Panorama and Firewall) and deleting the Deployment Profiles in the CSP Account

6.1 Remove Firewall Ressource Group

6.2 Remove Panorama Ressource Group

6.3 Remove Deployment Profiles