How to configure the schedule configuration backup

Preparing Panorama  for a scheduled configuration backup

• Any Panorama
• PAN-OS 8.1.x or above
• SSH client software (similar to Openssh client for windows or SSH client software of MacOS / Linux)
• OpenSSH server supporting secure copy (SCP)

1. Gather the public key from the remote secure copy (SCP) server. 

• This can be obtained by running ssh-keyscan from the Linux or Mac host to get the RSA key from a remote OpenSSH Server supporting SCP.
• The equivalent Microsoft Windows command is ssh-keyscan.exe which is only available after installing OpenSSH for windows. Replace x.y.z.q in the command with the server IP.

ssh-keyscan -4 -p 22 -t rsa x.y.z.q
x.y.z.q ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCgdJ6N5SG+YFmBF7GGS/jtjvjIRmv85uO0+V0A6YsitlXqwBVkKl74PmUb9ZSTwwIi5Bef2bIesiDTnefbG8qRak+Eja0QpFwPS9tVpaF3G4FELyKjjbKzL8gORKQVHCRdLhVW8EpPQB7WuqjdVuCUQD9hyB9H6Urp/7vSpygyZTVeqJfx2A23FVxLmB+WzIdC4lwMbmhuvqTCZWzH6TXS+bOgkQQrsxtBbmhM9ozpDebdFYxQ2G1QNmzV9Q71gDwR5QybiyRCFdQpC33QDbntKSFdutcjp+yrV5rWm+U/30+33obMJHG8+R18EQHUBlRteaZfEuiyQ7CqGZqOUE0z

2. Update the remote host public key to the Panorama or the firewall SCP client

• Log into panorama or firewall command-line interface (CLI) and then execute the CLI command "test scp-server-connection confirm" command to install the ssh host key

admin@Panorama> test scp-server-connection confirm hostname x.y.z.q key "x.y.z.q ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCgdJ6N5SG+YFmBF7GGS/jtjvjIRmv85uO0+V0A6YsitlXqwBVkKl74PmUb9ZSTwwIi5Bef2bIesiDTnefbG8qRak+Eja0QpFwPS9tVpaF3G4FELyKjjbKzL8gORKQVHCRdLhVW8EpPQB7WuqjdVuCUQD9hyB9H6Urp/7vSpygyZTVeqJfx2A23FVxLmB+WzIdC4lwMbmhuvqTCZWzH6TXS+bOgkQQrsxtBbmhM9ozpDebdFYxQ2G1QNmzV9Q71gDwR5QybiyRCFdQpC33QDbntKSFdutcjp+yrV5rWm+U/30+33o"

Installed ssh host key for x.y.z.q

3. Test  the SCP server connection from the panorama or the firewall CLI

admin@Panorama> test scp-server-connection initiate hostname x.y.z.q username test password paloalto

SSH connection to x.y.z.q succeeded.
File ssh-export-test.txt created.

4. Now the scheduled export can be done successfully using GUI: Panorama > Scheduled Config Export