Prerequisites
- The Lens agent can reach the firewall management interface over HTTPS and UDP 161; SSH is required only for an approved fallback.
- A dedicated administrator with the minimum read permissions needed for API evidence collection is available.
- An API key is generated for that account and has a defined rotation policy.
Required configuration values
Record the firewall management address, SNMP credential, and API key in the Lens agent setup UI. Allow API and SNMP only from the agent host or management subnet. Use HTTPS and set a finite API-key lifetime where policy permits.
Configure the device
Replace LENS_READONLY before pasting. Commit the candidate configuration after reviewing it. Limit inbound SNMP and API access to the Lens agent on the management-interface profile or a permitted-IP administrator profile.
configure
set deviceconfig system snmp-setting access-setting version v2c snmp-community-string LENS_READONLY
commitCreate a dedicated read-only PAN-OS administrator, set its permitted IP address to the Lens agent, generate an API key for that account, and configure the API-key lifetime. Enter the API key and SNMP community in the Lens agent setup UI.
Validate collection
Lens should inventory the firewall and collect system information, interfaces, routes, system-log evidence, and a sanitized running configuration through the API.
Troubleshooting
Run show deviceconfig system snmp-setting to confirm the configured community. Check the management-interface profile, HTTPS reachability, API-key lifetime, and administrator role before expanding permissions.