Panorama Operations Guide

Purpose

This document covers Panorama operational procedures — disk sizing, log forwarding configuration, PAN-OS upgrades, and known operational constraints. It incorporates lessons learned from the disk space failures that took down both the original AWS and DDE Panorama instances in early 2026.

Deployment Overview

Environment	Panorama	PAN-OS	Status
AWS DR	Networking account (238342914131)	12.1.2	✅ Operational
DDE	Azure DDE firewall subscription	12.1.2	✅ Rebuilt — firewall reconnection pending
Azure production	Not yet deployed	—	📅 Phase 2 (June/July 2026)

Disk Sizing — Critical Lesson

Root cause of original Panorama failures: PAN-OS creates fixed partition sizes on the system disk regardless of total disk capacity. On a single-disk deployment, log partitions fill the fixed allocation, then Panorama becomes unresponsive with no warning.

Required Configuration: Separate Log Disk

All Panorama instances must use a separate dedicated log disk attached as a second volume. PAN-OS auto-detects an additional disk and uses it for log storage automatically.

Disk	Purpose	Size
System disk	PAN-OS OS and config	81 GB (AWS) / standard (Azure)
Log disk	Panorama logs	100 GB minimum

Azure: Attach an additional managed disk and enable encryption_at_host. Note: Palo Alto Marketplace images do not support encryption_at_host — use a disk encryption set as the compensating control.

AWS: Attach a second EBS volume. PAN-OS will auto-detect it on boot.

Local Log Retention Settings

Even with a separate log disk, configure aggressive local retention to prevent disk exhaustion over time. In Panorama CLI or GUI:

set deviceconfig system log-storage max-num-images 2
set deviceconfig system log-storage max-num-config-backups 10

These settings cap the number of stored system images and config backups to prevent unbounded disk growth.

Disk Space Alert

Configure an 80% disk utilization alert on Panorama:

Azure: Azure Monitor metric alert on disk usage
AWS: CloudWatch alarm on EBS volume metric

Alert routes to IT admin email. Do not wait for Panorama to become unresponsive — 80% threshold gives time to act.

Log Forwarding

Panorama must forward logs to external storage. Storing logs only locally on Panorama disk is what caused the original failures.

Configure Syslog Forwarding

In Panorama → Device → Server Profiles → Syslog, add a syslog server profile pointing to the local syslog VM:

Parameter	Value
Name	`arctic-wolf-syslog`
Syslog Server	Syslog VM private IP
Transport	UDP
Port	514
Format	BSD (default)

Apply the syslog server profile to all log forwarding profiles across all device groups.

Log Forwarding to Archive Storage

The syslog VM receives logs from Panorama and ships them to S3 / Azure Storage archive. This is configured on the syslog VM (syslog-ng), not on Panorama directly.

See Palo Alto Config Backup & Audit for syslog VM architecture details.

Termination Protection

Termination protection must be enabled on all Panorama instances. An accidentally terminated Panorama instance loses all connected firewall configurations and requires a full rebuild.

AWS: Enable via EC2 console or Terraform disable_api_termination = true.

Azure: Enable delete lock (azurerm_management_lock resource type CanNotDelete) via Terraform.

Connecting a Firewall to Panorama

When a new firewall is deployed or an existing firewall needs to reconnect:

Step 1: Set Panorama IP on the firewall

On the firewall CLI or GUI:

set deviceconfig system panorama-server <panorama-mgmt-ip>
commit

Or via the firewall GUI: Device → Setup → Management → Panorama Settings.

Step 2: Accept the device in Panorama

In Panorama → Managed Devices → Summary:

The firewall will appear as "Pending" or "Connected"
Click the device and set the device group and template stack assignments
Commit and push

Step 3: Validate the connection

On the firewall CLI:

show panorama-status

Expected output: Panorama Server 1 : Connected

If the firewall shows "Not Connected" after setting the IP and committing, a firewall reboot is required to restore the Panorama management plane connection. This is a known PAN-OS behavior — the management plane tunnel does not always establish without a restart.

DDE current status: DDE Panorama rebuilt but firewall reconnection pending. Reboot required during next maintenance window.

PAN-OS Upgrade Procedure

⚠️ Upgrade Panorama before upgrading managed firewalls. Panorama must always run the same or newer PAN-OS version than managed devices.

Pre-upgrade checklist

[ ] Confirm Panorama disk space is sufficient (>50% free on log disk)
[ ] Export a Panorama config backup
[ ] Confirm all managed firewalls are connected and committed
[ ] Review Palo Alto release notes for the target version
[ ] Schedule during low-traffic maintenance window
[ ] Notify relevant stakeholders — Panorama will be briefly unavailable during upgrade

Upgrade steps

Download the target PAN-OS image: Panorama → Device → Software → Check Now
Install the image (Panorama stays running during download)
Activate the image — Panorama reboots (~5-10 minutes)
Verify Panorama is back online and all managed devices reconnected
Upgrade managed firewalls one at a time after confirming Panorama is stable

SCP Workaround

If the built-in upgrade path is unavailable (e.g., direct internet access from Panorama is blocked), download the PAN-OS image via the Palo Alto support portal and upload it via SCP to the Panorama /tmp directory, then install from the local image.

bash

scp PanOS_Panorama-12.1.x.xfr admin@<panorama-mgmt-ip>:/tmp/

Log into Panorama GUI → Device → Software → Upload to complete the install.

Config Backup from Panorama CLI

In addition to the automated daily backup (see Palo Alto Config Backup & Audit), you can manually export a Panorama config from the CLI:

bash

# Export Panorama running config
scp export configuration from running-config.xml to <scp-target>

# Export via API
curl -k "https://<panorama-ip>/api/?type=export&category=configuration&key=<api_key>" \
  -o panorama-config-$(date +%Y-%m-%d).xml

Troubleshooting

Symptom	Likely Cause	Resolution
Firewall shows "Not Connected" after setting Panorama IP	Management plane tunnel not established	Reboot the firewall
Panorama disk full — unresponsive	Log disk exhaustion	Attach separate log disk; configure external syslog forwarding
Cannot push config to firewall	Firewall not committed or in candidate config state	Run `commit` on the firewall first, then push from Panorama
`max-num-images` warning on upgrade	Too many PAN-OS images stored	Run `delete system software version <old-version>`
Panorama shows firewall as "Out of Sync"	Local commit on firewall bypassed Panorama	Push policy from Panorama to re-sync

Compliance Relevance

Requirement	How Panorama Addresses It
HIPAA §164.312(b) — Audit controls	Centralized log management and forwarding
HIPAA §164.308(a)(1) — Risk management	Centralized security policy management
SOC2 CC6.6 — Logical access	Consistent policy enforcement across all firewalls
Change management	Config backup with diff alerting provides audit trail

Document History

Date	Change	Author
March 2026	Initial draft — incorporates lessons from disk space failures; covers separate log disk requirement, aggressive local retention, termination protection, log forwarding, upgrade procedure, and DDE reconnection pending	Rory

Panorama Operations Guide ​

Purpose ​

Deployment Overview ​

Disk Sizing — Critical Lesson ​

Required Configuration: Separate Log Disk ​

Local Log Retention Settings ​

Disk Space Alert ​

Log Forwarding ​

Configure Syslog Forwarding ​

Log Forwarding to Archive Storage ​

Termination Protection ​

Connecting a Firewall to Panorama ​

Step 1: Set Panorama IP on the firewall ​

Step 2: Accept the device in Panorama ​

Step 3: Validate the connection ​

PAN-OS Upgrade Procedure ​

Pre-upgrade checklist ​

Upgrade steps ​

SCP Workaround ​

Config Backup from Panorama CLI ​

Troubleshooting ​

Compliance Relevance ​

Document History ​

Related Documentation ​