SCM Firewall Onboarding Guide

End-to-end procedure: prerequisites, device onboarding, and post-onboarding configuration

Procedure Overview

Work through each step in order; each builds on the previous one. Complete every required item before moving to the next step.

1. Step 1. Hardware & Software Compatibility — supported models, PAN-OS versions, single vsys
2. Step 2. Licensing & Account Readiness — Activation Console, SCM license, device association, deployment profiles
3. Step 3. Network & Connectivity — ports, FQDNs, DNS, NTP, proxy configuration
4. Step 4. Device Certificates — install and verify certificates on all firewalls
5. Step 5. VM-Series Specific Prerequisites — credit activation, deployment profiles, auto-registration PINs, cloud platform readiness (VM-Series only)
6. Step 6. Onboard Devices to Strata Cloud Manager — configure firewalls for cloud management, associate in SCM, verify connectivity
7. Step 7. Post-Onboarding Setup & Automation — CloudConnector plugin, device labels, onboarding rules, configuration push, policy labels

Step 1: Hardware & Software Compatibility

Before anything else, confirm your devices can actually be onboarded to SCM.

1.1 Supported Firewall Models

Verify your hardware is on the supported list for SCM cloud management.

1.2 PAN-OS Version Requirements

Step 1 Checklist

Step 2: Licensing & Account Readiness

With hardware and software confirmed, ensure you have the right licenses and accounts in place.

2.0 Configure Okta SSO Authentication (Optional)

2.1 Choose Your SCM License Tier

2.2 Activate & Verify License Status

1. Log in to the Activation Console (also referred to as “the Hub”).
2. Navigate to Common Services > Tenant Management.
3. Verify your SCM license tier (Essentials or Pro) is active.
4. Check that the Activation Status shows Complete.
5. If using SCM Pro, confirm Strata Logging Service shows as included.
6. If using SCM Essentials and you need logging, activate the SLS add-on separately.

2.3 Verify Deployment Profile Association (VM-Series only)

This section applies if you are deploying VM-Series firewalls using Software NGFW Credits. It assumes you have already activated a credit pool and created a deployment profile in the Customer Support Portal. If you have not yet created a deployment profile, see Create a Deployment Profile first.

Once your SCM license activation is complete, verify that your deployment profile is associated with the correct tenant:

1. In the Activation Console, navigate to Common Services > Tenant Management > Deployment Profiles.
2. Locate your deployment profile (search by name or auth code starting with “D”).
3. Check the Profile Association Status:
   • If it shows Complete — your profile is correctly associated. Proceed to Section 2.4.
   • If it shows Associating — provisioning is in progress. Wait up to 50 minutes for it to complete.
   • If your deployment profile is not listed — it has not been associated with this tenant yet. Follow the steps below.

Associate a Deployment Profile with Your Tenant

If your deployment profile does not appear under the tenant’s Deployment Profiles tab:

1. Navigate to Common Services > Subscriptions & Add-ons.
2. Look for your deployment profile under Ready for Activation — click Activate Now.
   Alternatively: In CSP under Software NGFW Credits > Current Deployment Profiles, click Finish SetUp next to the profile — this redirects you to the Activation Console.
3. Authenticate with SSO if prompted.
4. On the Activate Subscriptions based on Deployment Profiles page:
   • Select the CSP account you are subscribed to.
   • Select (or create) the target tenant and region.
   • Select the deployment profile to associate (search by name or auth code).
5. (Optional) Select Additional Services such as Cloud Identity Engine.
6. Agree to Terms and Conditions → click Activate.
7. Wait for the Profile Association Status to show Complete (provisioning takes approximately 15–50 minutes).

Reference: Create a Deployment Profile | Activate the Deployment Profile

2.4 Associate Devices to Tenant

1. In the Activation Console, navigate to Common Services > Device Associations.
2. Click Add Devices.
3. Select all firewalls to be onboarded by their serial numbers.
4. Confirm each device has an active support license.
5. Click Save.

Step 2 Checklist

Step 3: Network & Connectivity

This is the step most commonly missed. All ports and FQDNs must be open before you attempt onboarding.

3.1 Required Outbound Ports

3.2 Required FQDNs — Certificate Services

These must be reachable for device certificates to install and renew.

3.3 Required FQDNs — Strata Cloud Manager

3.4 Required FQDNs — Strata Logging Service

3.5 Required App-IDs

If using a Palo Alto Networks firewall to secure traffic between your devices and cloud services, allow these App-IDs in security policy.

3.7 Proxy Considerations

3.8 Configure DNS & NTP

Both DNS and NTP must be configured on every firewall before onboarding. NTP is required for certificate validation.

1. Log into the firewall web interface.
2. Navigate to Device > Setup > Services → edit Services.
3. Configure DNS — enter Primary and Secondary DNS server addresses.
4. Select NTP → enter Primary NTP server (and optional Secondary).
5. Click OK → Commit.
6. Verify NTP sync:

admin> show ntp

Expected result: status shows synced.

3.9 Validate Connectivity

Run these commands from each firewall CLI to confirm network readiness:

# Test DNS resolution to SCM discovery service
admin> ping host ds-cloudmgmt.paloaltonetworks.com

# Test DNS resolution to certificate services
admin> ping host certificate.paloaltonetworks.com

# Verify NTP sync
admin> show ntp

# Check license status
admin> request license info

Step 3 Checklist

Step 4: Install Device Certificates

Device certificates authenticate your firewalls with Palo Alto cloud services. This must be done before onboarding.

admin> request certificate fetch otp 

admin> show device-certificate status

admin> request certificate fetch

admin> request wildfire registration channel public

Step 4 Checklist

Step 5: VM-Series Specific Prerequisites

VM-Series firewalls follow a different onboarding path than hardware NGFWs. Before onboarding to SCM, you must activate your credit pool, create deployment profiles, and ensure your cloud platform allows management-plane connectivity.

5.1 Licensing Model Comparison

Understand which licensing model applies to your VM-Series deployment.

5.2 Activate Software NGFW Credit Pool

If using Software NGFW Credits, your credit pool must be activated before creating deployment profiles.

1. Check for the activation email from Palo Alto Networks containing:
   • Credit pool ID
   • Start and end dates (term: 1–5 years)
   • Total credit amount
2. Click the activation link or log into CSP.
3. Navigate to Products > Software NGFW Credits > Start Activation.
4. Select the credit pool to activate.
5. Select the support account to associate with.
6. Choose a default credit pool for deposits.
7. Click Deposit Credits to complete activation.

5.3 Verify Deployment Profile Status

You should have already created and activated your deployment profile in Section 2.3. Before continuing, confirm:

• Profile Association Status shows Complete (not “Associating” or “Pending”) in Common Services > Tenant Management > Deployment Profiles
• If the status is still “Associating,” wait up to 50 minutes for provisioning to finish

5.4 Generate Auto-Registration PIN

The auto-registration PIN enables automatic device certificate installation during VM-Series bootstrap, eliminating the need for manual OTP-based certificate fetch (Step 4).

1. Log into CSP.
2. Navigate to Products > Device Certificates.
3. Generate a Registration PIN for your VM-Series deployment.
4. Record both values:
   • PIN ID (e.g., abcdefgh1234****)
   • PIN Value (e.g., zyxwvut-0987****)

These values are used in the bootstrap configuration (init-cfg.txt or cloud user data):

# In init-cfg.txt or cloud instance user data:
vm-series-auto-registration-pin-id=abcdefgh1234****
vm-series-auto-registration-pin-value=zyxwvut-0987****

5.5 Cloud Platform Readiness

Your cloud environment must allow the VM-Series management interface to reach Palo Alto Networks cloud services. This is in addition to the general network requirements in Step 3.

5.6 Configure “Managed By” Setting

Before onboarding a VM-Series firewall to SCM, set the management mode on the device.

1. Log into the firewall web interface.
2. Navigate to Device > Setup > Management.
3. Under Panorama Settings, select Managed By Cloud Service.
4. Set the connection port: 3978 (default) or 443.
5. (Optional) Enable Compress Config for large configurations.
6. Commit.

Step 5 Checklist (VM-Series Only)

Step 6: Onboard Devices to Strata Cloud Manager

6.1 NGFW Onboarding

This workflow applies to both hardware NGFWs and VM-Series firewalls.

Step 1: Configure the Firewall Locally

1. Verify DNS and NTP are configured under Device > Setup > Services.
2. Navigate to Device > Setup > Management > Panorama Settings.
3. Select Managed By Cloud Service.
4. (PAN-OS 11.2+) Choose communication port: Default (dedicated port 3978) or 443 (standard SSL).
5. (Optional) Enable Compress Config for faster configuration transfers.
6. Commit changes.

Step 2: Associate Devices in SCM

1. In SCM, go to System Settings > Device Associations > Add Devices.
2. Select the serial numbers of firewalls to onboard.
3. Associate each firewall with Strata Cloud Manager or AIOps for NGFW.

Step 3: Move to Cloud Management

1. Go to System Settings > Device Management > Available Devices.
2. Select the firewall(s).
3. Click Move to Cloud Management.

Step 4: Verify

1. In SCM, check Cloud Managed Devices — status should show Success.
2. On the firewall CLI, run:

admin> show cloud-management-status

Confirm Connected shows Yes.

6.2 Prisma Access Onboarding

6.3 Enable Telemetry

Telemetry is required for SCM to collect health data via Strata Logging Service.

Auto-Enabled Versions (no action needed)

Manual Enablement (older PAN-OS versions)

If your firewall is running a version below the auto-enable thresholds:

1. Register the device in CSP under Assets > Devices.
2. Ensure the device certificate is installed (see Step 4).
3. Manually enable telemetry sharing on each device.

Verify Telemetry Status

# Check telemetry status and last upload time
admin> show device-telemetry details

# Check telemetry region and configuration
admin> show device-telemetry settings

# Force immediate telemetry collection
admin> request device-telemetry collect-now

Step 6 Checklist

Step 7: Post-Onboarding Setup & Automation

These steps are optional but recommended for production environments, especially at scale.

7.1 Panorama CloudConnector Plugin

If you use Panorama and want BPA/Policy Analyzer features in SCM, install the CloudConnector plugin.

Requirements

• Panorama running PAN-OS 10.2.3+
• Valid device certificate on Panorama
• Telemetry enabled on Panorama
• AIOps for NGFW Premium or SCM Pro license (required for Policy Analyzer and BPA)

Installation

1. Enable via CLI:

admin> request plugins cloudconnector enable basic

Regional FQDNs for CloudConnector

Panorama must be able to reach your region's FQDN on TCP 443.

7.2 Device Labels & Onboarding Rules (At Scale)

For environments with many devices, automate onboarding with labels and rules.

Device Labels

1. Navigate to Configuration > NGFW and Prisma Access > Setup > Device Onboarding > Device Labels.
2. Create labels to group devices by software version, location, role, etc.
3. Apply labels to devices during or after onboarding.

Onboarding Rules

Onboarding rules automatically assign configurations to devices as they connect to SCM.

7.3 Post-Onboarding Configuration in SCM

Once devices are onboarded, configure them through SCM.

General Settings

• Domain name, login banners, certificates, time zones
• Tunnel acceleration for improved VPN performance
• Session settings — VPN session timeouts and parameters

Folder Management

Organize firewalls into folders for group configuration.

Interface Assignment

SCM provides predefined interface variables for consistent configuration across devices:

Verify or customize these assignments to match your physical interface topology.

Push Configuration

7.4 Using Labels for Policy Organization

Beyond device labels used for onboarding automation, SCM supports labels on folders, snippets, and policy objects. Labels act as metadata you can use to filter, search, and organize configuration at scale. They have no effect on policy enforcement; they are organizational aids only.

Step 7 Checklist

Pre-Flight Checklist

Use this as a final go/no-go before starting the onboarding process.

Troubleshooting

Certificate Fetch Issues

VM-Series Specific Issues

Connectivity Validation

Cloud Management Status: Not Connected

admin> debug software restart process cloud_mgr

Telemetry Not Appearing in SCM Dashboard

Configuration Push Fails After Onboarding

Diagnostic Commands

# Device certificate status
admin> show device-certificate status

# NTP synchronization
admin> show ntp

# DNS resolution test
admin> ping host ds-cloudmgmt.paloaltonetworks.com

# License status
admin> request license info

# Management interface MTU
admin> show system setting mtu

# Install certificate with OTP (standalone)
admin> request certificate fetch otp <value>

# Install certificate on TPM devices (no OTP needed)
admin> request certificate fetch

# WildFire registration refresh
admin> request wildfire registration channel public

# VM-Series: Verify management mode
admin> show system info | match cloud

# VM-Series: Check cloud service connection
admin> show cloud-connector status

# Cloud management connection status
admin> show cloud-management-status

# Telemetry status and last upload time
admin> show device-telemetry details

# Telemetry region and configuration
admin> show device-telemetry settings

# Force immediate telemetry collection
admin> request device-telemetry collect-now

# Restart cloud management process
admin> debug software restart process cloud_mgr

# Check config logs for errors
admin> less mp-log configd.log

# CloudConnector plugin status (Panorama)
admin> request plugins cloudconnector show-status

Source Documentation