Palo Alto Panorama Integration

Overview

The Palo Alto Panorama integration discovers the firewalls that Panorama manages and ingests them into NetBox via the Diode SDK. It connects to one Panorama over its XML API, reads Panorama's inventory of managed firewalls, and asks Panorama to relay a small number of read-only operational commands to each connected firewall. Each firewall therefore needs no credential of its own, and the integration never connects to a firewall directly. Discovered data is staged as deviations in NetBox Assurance, where you review and apply changes before they are written to NetBox.

After a sync you can see every managed firewall with its model, PAN-OS version, management address, interfaces, routing instances, and high-availability role, together with the Panorama device group and template stack it belongs to. Run the integration on a schedule to surface changes, such as a new firewall, a PAN-OS upgrade, or a changed interface address, as deviations in Assurance.

What Gets Synchronized

• Firewalls - each firewall in Panorama's inventory, as a device with its model, PAN-OS version, serial number, and the Firewall role
• Panorama groupings - each firewall's device group, template stack, and templates, in custom fields
• High-availability state - each pair member's state, its peer's serial number, and the pair's mode, in custom fields
• Management port - an interface named management, its IPv4 and IPv6 addresses, and the firewall's primary IP addresses
• Interfaces - every dataplane interface the firewall reports, including subinterfaces, aggregate (LAG) interfaces, and their members
• Routing instances - each virtual router on each firewall, as a VRF. Firewalls that use Advanced Routing (logical routers) have not been tested. See Known Limitations
• IP addresses - the addresses on each interface, in the interface's VRF
• VLANs - the 802.1Q tag of each tagged subinterface, as a VLAN in a VLAN group for each firewall
• MAC addresses - each interface's MAC address, where it is unique across the run
• Virtual systems - each virtual system of a multi-vsys firewall, as a virtual device context

Key Features

• One endpoint for the whole estate - one Panorama credential and one reachable address. Firewalls are read through Panorama's relay
• What the firewall reports - interface data comes from each firewall's own answers, so a firewall that has not received a pushed template is recorded as it is, not as Panorama intends it to be
• Serial-number identity - each firewall records its serial number as its matching ID, so a firewall that two Panoramas report becomes one device, and a firewall renamed in NetBox is found again on the next run
• Per-firewall routing instances - each firewall's virtual routers become VRFs of their own, so the identical addresses of a high-availability pair stay separate
• Separate management routing instance - the management port's address sits in its own VRF, because PAN-OS routes the management port apart from every virtual router
• Multi-vsys support - each virtual system of a multi-vsys firewall becomes a virtual device context, with each interface pointing at the one it belongs to
• Scope by device group or serial - sync only the firewalls in chosen device groups, including their child groups, or with chosen serial numbers
• Flexible site placement - every firewall lands in one site named after its Panorama, in a site you name, or in a site taken from its hostname
• Bootstrap mode - creates custom fields, tags, the manufacturer, and the device role in NetBox before the first full sync
• Operational drift detection - run on a schedule to surface firewall changes as deviations in NetBox Assurance

Integration Architecture

The Palo Alto Panorama integration is built on the NetBox Labs controller integrations framework:

• Standardized integration pattern - consistent approach across all controller integrations
• NetBox Assurance integration - uses NetBox Assurance for safe data ingestion and deviation management
• Agent based - runs as part of the NetBox Discovery agent ecosystem using the Orb Agent Pro image
• One-way sync - data flows from Panorama to NetBox only; nothing is written back to Panorama or to the firewalls

Compatibility

Supported NetBox Versions

• NetBox Cloud and NetBox Enterprise with NetBox Assurance

Supported Panorama Versions

• Panorama, through its XML API (/api/) over HTTPS. The REST API is not used
• The integration was tested against Panorama 12.1.7-h3 managing PA-VM firewalls on PAN-OS 11.2.5, using the classic routing engine (virtual routers)
• Only firewalls that Panorama manages are read. A firewall that Panorama does not manage is not synced

Before You Start

Decide where the firewalls land before the first run, because a later change moves every firewall:

• Site - by default, every firewall from one Panorama lands in one site named after that Panorama. Set SITE_NAME to use a site you choose, or SITE_FROM_HOSTNAME_REGEX to take the site from each firewall's hostname.
• PANORAMA_NAME - names the Panorama instance in the default site, a tag, and a custom field. Without it, the name is the hostname that Panorama reports, so renaming Panorama, or pointing the policy at the other Panorama of a high-availability pair, moves every firewall to a new site.

See Choosing a site and a Panorama name before you configure the agent.

Known Limitations

Two firewalls that report the same hostname into one site become one NetBox device. High-availability pairs are recorded in custom fields, not as NetBox redundancy groups. A MAC address that more than one interface reports is not recorded. Firewalls that use Advanced Routing have not been tested. See Known Limitations for the full list.