Skip to main content

Palo Alto Panorama — Group Export

A Connect Group is a named list of IP addresses/CIDRs, kept up to date automatically as matching resources change. Group Export pushes a Group to your Palo Alto firewalls (managed by Panorama) as a Dynamic Address Group (DAG).

Each Connect Group maps to a tag (registered on each member IP) and a DAG whose match filter is that tag. Adding or removing IPs only changes tag registrations on the firewall — instant, no Panorama commit required. Creating, renaming, or deleting the DAG itself changes Panorama configuration and does require a commit + push, which the Connector handles for you.

Set up a Palo Alto account​

  1. In Connect, go to Settings > Accounts and add a new account.
  2. Cloud Provider: Palo Alto Networks. Give it an account ID and name.
  3. Save — you land on the Provision page. Fill in:
    • Connector — the Connector you paired earlier. (Required for Palo Alto.)
    • Panorama Hostname — your Panorama's IP or hostname.
    • Username / Password — Panorama admin credentials.
    • Device Group — the exact Panorama device group name (case-sensitive) whose firewalls should receive the DAG.
    • Allow Self-Signed Certificate — turn this on only if your Panorama uses a self-signed certificate (common in lab/test environments). Leave it off for a production Panorama with a CA-signed certificate.
  4. Save.

The Connector picks up the account on its next poll (within ~30 seconds).

Export a Group​

  1. In Connect, go to Groups > New Group.
  2. Set Update to Automatic so membership stays current with no manual refresh.
  3. Set Export To to your Palo Alto account.
  4. Build your membership filters (tags, type, vendor, CIDR, account, region, etc.) and confirm the preview table shows the members you expect.
  5. Save. Because the group updates automatically, Connect will warn that saving exports all current matches — confirm.

Within about 30 seconds the Connector picks up the export job. You can watch its progress under Settings > Connectors > Jobs in Connect.

Verify it landed​

  1. In the Panorama UI, go to Objects > Address Groups and select your device group (not Shared). You should see a new Dynamic address group referencing your export.
  2. Resolved members only live on the managed firewall, not Panorama itself. On the firewall, check Monitor > IP-Tag Mapping for your tagged IPs, and Objects > Address Groups to see the DAG's resolved members.
  3. If the DAG shows no members on the firewall, Panorama may not have pushed it yet — this needs either Share Unused Address and Service Objects with Devices enabled (Panorama's default), or a policy referencing the DAG, followed by a commit and push to devices.

What happens when you change things​

ActionResult
Edit the Group's filtersMembership recalculates on save; tags register/unregister on the firewall immediately — no commit needed.
A resource gains/loses a matching tagAutomatic groups pick up the change on the next refresh.
Rename the GroupThe DAG is renamed in place; existing policy references are preserved.
Add/remove a target under Export ToMembers sync to the new target and are removed from any dropped target.
Delete the GroupThe DAG and its tagged IPs are left in place on Panorama/the firewall — remove them manually if unwanted.

For common issues, see Troubleshooting.