Palo Alto Networks¶

Overview¶

HPE Morpheus Software integrates with Palo Alto Networks next-generation firewalls and Panorama management platforms to provide centralized security policy management alongside cloud provisioning workflows. The integration allows HPE Morpheus Software to apply security policies, manage firewall rules, and enforce zone-based segmentation as part of automated infrastructure deployment.

Key capabilities of the Palo Alto Networks integration include:

• Security policy and rule management

• Zone-based firewall configuration

• Address group and service group management

• Panorama device group support

• Security profile assignment during provisioning

• Commit workflow for staged policy changes

Prerequisites¶

Before configuring the Palo Alto integration in HPE Morpheus Software, ensure the following:

• A Palo Alto Networks firewall or Panorama appliance is accessible from the HPE Morpheus Software appliance over HTTPS (port 443)

• An API-capable administrative user account exists on the Palo Alto device

• API access is enabled on the management interface

• (Panorama) The desired device groups and templates are configured

Add Palo Alto Integration¶

1. Navigate to Infrastructure > Network > Integrations

2. Click + ADD

3. Select Security > Palo Alto

4. Complete the following fields:

   NAME:

   A name for the Palo Alto integration in HPE Morpheus Software

   URL:

   The management URL of the Palo Alto firewall or Panorama (e.g., https://192.168.1.1)

   USERNAME:

   API-capable admin username

   PASSWORD:

   Password for the admin account

5. Click ADD NETWORK INTEGRATION

Once added, HPE Morpheus Software will connect to the Palo Alto appliance and sync existing security configuration including zones, address objects, address groups, services, security rules, and NAT rules.

Configure Cloud Security Mode¶

To make the Palo Alto integration available during provisioning:

1. Navigate to Infrastructure > Clouds

2. Select and edit the target Cloud

3. Expand the Advanced Options section

4. Select the Palo Alto integration in the SECURITY SERVER dropdown

5. Click SAVE CHANGES

Managing Security Policies¶

After the integration is established, security policies can be managed from the integration detail view:

Firewall Rules¶

1. Navigate to Infrastructure > Network > Integrations

2. Select the Palo Alto integration

3. Click the Firewall tab

4. From here, create, edit, or delete security rules

When creating rules, the following fields are available:

Name:

Rule name (required)

Description:

Optional rule description

Enabled:

Toggle rule enforcement

Priority:

Rule priority/order

Source Zone:

Source security zone

Destination Zone:

Destination security zone

Source Address:

Source address or address group

Destination Address:

Destination address or address group

Service:

Service or service group

Action:

Allow, Deny, Drop, or Reset

Commit Workflow¶

Palo Alto Networks uses a commit-based configuration model. Changes made through HPE Morpheus Software are staged as candidate configuration and must be committed to take effect:

1. Make desired changes to security rules, groups, or policies

2. Review pending changes

3. Click COMMIT to apply changes to the running configuration

4. Alternatively, click DISCARD to abandon pending changes

Security Groups for Provisioning¶

When a Cloud has a Palo Alto security server configured, security groups become available during instance provisioning:

1. During instance provisioning, in the Configure section

2. Expand Security options

3. Select the desired security group or policy to apply to the instance

4. The security policy will be applied as part of the provisioning workflow

Troubleshooting¶