How to Register a Palo Alto Networks Firewall on the Support Portal and Apply License Authorization Codes

Transcription

1 How to Register a Palo Alto Networks Firewall on the Support Portal and Apply License Authorization Codes Purpose: This document provides the instructions to register a Palo Alto Networks firewall on the Support Portal, create a user login and apply license authorization codes. Every Palo Alto Networks firewall must be registered on the Support Portal in order to activate the service entitlement (access to new software downloads and Support), threat prevention and URL filtering licenses. Some exceptions to this process will be discussed in Part 2 of this document. Part 1: Register a device, create a new Support Portal login and apply auth codes: Browse to or from the firewall WebUI Device tab go to Support >Support Home If you do not have an existing Support Portal account and login, you will be creating one at this time. Submit your address and captcha words. Then fill in your personal information as appropriate. Your device serial number can be found on the back of the unit, on the WebUI under Dashboard > General Information, or in the CLI command, >Show system info. 1

2 You will be asked to answer three security questions for password retrieval once your account has been created. The first user to register a device under a domain name not already registered on the Support Portal, will become the super user for that company. The newly registered device will appear under My Devices: Note, the device below is registered but has no licensing applied. Software Warranty Support is the basic 90 day warranty shipped with every unit. Clicking Trial Licenses will allow activation of 30 day trial Threat Prevention, URL Filtering and Global Protect licenses. Click Edit and the option to make the device public, meaning all users on the account can view it, will appear. Check the box as appropriate and Save. 2

3 When you are ready to activate your licensing, click Activate and apply the authorization codes, one at a time, which have been ed to you in your Palo Alto Networks Purchase Order. Support may need to search for these auth codes by doing an Operations Lookup on the Entitlement server using a device serial number. With some exceptions, generally you will have 3 auth codes to enter, one for Support, one for Threat Prevention (TP) and one for URL filtering. You should now see your active licensing under My Devices: Device registration for additional users on the Support Portal account The super user on the Support Portal account can create additional user logins by clicking Users and Accounts and filling in the appropriate information. 3

4 If this user wishes to register a device, he can log in using his credentials, click My Devices and fill in the device registration form at the bottom of the display: A new user to an existing company account may also create a login by registering a device just as the super user did. He will have two options available to him: 4

5 1. Yes, Add me to the existing account The new user must be accepted by the super user before he will be added to the company account. An similar to the one below is generated to the super user for approval when the registration form is completed. While the device is registered, until the super user clicks the link in the to add this new user to the company account, he will be isolated. This user will not see any of the rest of the devices belonging to the company, nor will any other company users see the device he registered. 2. No, I would like a stand alone account In some instances, a user may prefer to have his account remain separate from the rest of his company. Large consulting firms or agencies with multiple departments may have no interaction with other employees or departments, though they all fall under the same domain. This user may select the option to isolate himself from the rest of the domain and will be able to view only devices he has registered. License retrieval on the firewall: 5

6 To retrieve the licenses on the firewall go to the Device tab of the WebUI> Licenses > Retrieve license keys from license server. You also have an option to Activate features using the authorization codes, if you have not already done so from the Support Portal. Additionally, you have the option to Manually upload license keys if your firewall has no Internet access. To perform a manual upload you would need to apply the authorization codes as previously described and download the keys to a laptop, which would, in turn, be connected to the firewall. Once the licenses have been retrieved, click Dynamic Updates and you should see the option to download Applications and Threats, Antivirus, and Activate URL Filtering. You can schedule your downloads and installs as well. An example of a Dynamic Updates page from a previously licensed firewall is shown below: 6

7 Troubleshooting Tips If your URL filtering shows a status of Activate No, use the following CLI command to start the download: >request url filtering upgrade brightcloud You can follow the progress of the job with the command: >tail follow yes mp log pan_bc_download.log If none of your licensing appears, verify that you have a DNS server configured on the firewall and are able to ping support.paloalotnetworks.com. Verify that there is no other firewall or policy blocking access to support.paloaltonetworks.com. If trial licensing still appears, delete it using the CLI command: >delete license key <tab to display keys>. Cut and past the old license key info and delete, then retrieve license keys again from the WebUI. Other useful CLI licensing commands: 7