I'm deploying a PAN-OS VM-Series firewall in AWS using CloudFormation. The bootstrap parameters are being passed directly through EC2 user data rather than stored in an object-storage bucket. The instance launches successfully and appears to have network connectivity, but it never connects to or registers with Panorama. This is a new setup, and I've also noticed that using Panorama's FQDN doesn't work, although the configuration still fails otherwise. What should I check?
3 Answers
Since this is a new deployment, connect to the instance over SSH and inspect the bootstrap and initialization logs. A configuration error during first boot can fail without being obvious from the CloudFormation status. Also verify that the Panorama address is resolvable from the firewall; if the FQDN fails, test with the Panorama IP temporarily to separate DNS issues from bootstrap problems.
Make sure the firewall is properly licensed and that the authentication details are valid. Depending on the deployment model, confirm the PAYG licensing or authorization code, and carefully verify the vm-auth-key in the user data. An expired or incorrect authorization value can stop the firewall from registering even when basic network connectivity works.
Is there a reliable way to identify an expired authorization code or another vm-auth-key mismatch from the instance logs or Panorama?
Check the CloudFormation parameters and the Panorama configuration for exact matches. The template stack name and device-group name need to correspond precisely to what exists in Panorama. Small differences in spelling or capitalization can prevent registration.
It has never worked yet, and I haven’t found anything conclusive in the logs. The Panorama FQDN is one of the first things I’m going to test more thoroughly.