I'm deploying a PAN-OS VM-Series firewall in AWS using CloudFormation. I'm passing the bootstrap parameters directly through EC2 user data rather than using an S3 bucket. The instance launches successfully and appears to have network connectivity, but it never connects to or registers with Panorama. This is a new setup, and I also noticed that using a Panorama FQDN does not seem to work. What should I check to troubleshoot the bootstrap process and Panorama registration?
3 Answers
Double-check the CloudFormation and bootstrap values that identify the Panorama target, including the template or stack name and device-group name. They need to match the corresponding Panorama configuration exactly. Also verify that the VM is licensed through PAYG or an authorization code and that the vm-auth-key in user data is valid.
Review the instance IAM role and the formatting of the bootstrap parameters as well. An overly long role name or malformed user-data value can cause cloud-init or the bootstrap process to fail without an obvious error. Confirm the role name meets AWS limits, then inspect cloud-init output and the firewall’s bootstrap logs to see whether the parameters were received at all.
Thanks, I’ll check the IAM role length and the cloud-init output as well.
Since this is a new deployment, connect to the instance over SSH and inspect the bootstrap and initialization logs carefully. Bootstrap failures can be quiet, so verify that the user-data parameters are being parsed and applied. Also confirm that the Panorama address is resolvable and reachable from the management interface. If the deployment previously worked and then stopped, expired licenses or credentials would also be worth checking.
This is a new setup. I haven’t found anything useful in the logs yet, but I did notice that the Panorama FQDN does not work. The configuration still fails when I use the address directly.
Is there a reliable way to detect a mismatch, such as an expired authorization code or an invalid vm-auth-key?