---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Palo Alto Networks firewall

# Palo Alto Networks firewall discovery {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Palo Alto Networks Firewall Discovery

The ServiceNow Discovery application uses the Next-Generation Palo Alto Firewall pattern to discover Palo Alto Networks firewalls within your network.
This pattern relies on SNMP calls and performs horizontal discovery to identify these firewall devices and populate their information in the CMDB.
To enable this functionality fully, customers may need to update the Discovery and Service Mapping Patterns application from the ServiceNow Store.
Show full answer Show less  

## Prerequisites

* Ensure SNMP access is enabled on the Palo Alto firewall devices.
* Configure SNMP credentials on your ServiceNow instance.
* Add the SNMP system OID record specific to Palo Alto Networks devices.
* Update the classifier and class for Palo Alto Firewall to enable recognition during discovery.
* Download and install the Firewall extension classes and the Palo Alto discovery pattern from the ServiceNow Store.
* Sync the discovery pattern with an appropriate MID Server to enable communication and data collection.

## Data Model and Collected Data

The pattern introduces a new CI class **Palo Alto Firewall Device \[cmdbcifirewalldevicepaloalto\]** extending the Firewall Device class. During discovery, the following key data fields are collected and stored in the CMDB:

* **IP Address:** Device IP
* **Serial Number:** Unique device identifier
* **Fully Qualified Domain Name (FQDN)**
* **Manufacturer**
* **Model ID**
* **Operational Status:** Active or inactive state
* **Hardware OS and Version**
* **Firmware Version**
* **Description:** Short device details

Additional related CI classes discovered include Network Adapter, IP Address, and DNS Name with relevant attributes such as MAC address, netmask, alias, and DNS hostname.

## CI Relationships and References

The pattern establishes relationships between discovered CIs to reflect network topology and device ownership, including:

* **Palo Alto Firewall Device owns Network Adapters and IP Addresses.**
* **Palo Alto Firewall Device uses Router Interfaces.**
* **Network Adapters own IP Addresses.**

References link these CIs for configuration management, enabling a comprehensive and connected view of your Palo Alto firewalls and their network components.

## Key Benefits for ServiceNow Customers

* Automated and accurate discovery of Palo Alto Networks firewalls using SNMP enhances CMDB completeness.
* Improved visibility into firewall device details, configurations, and operational status supports better network and security management.
* Relationships and references between CIs enable deeper insights into network topology and device dependencies.
* Installation via the ServiceNow Store simplifies deployment and updates of discovery patterns and extensions.  
The ServiceNow
Discovery application uses the Next-Generation Palo Alto Firewall pattern to find Palo Alto Networks firewalls. Discovering some of these resources might require updating to the latest version of the Discovery and Service Mapping Patterns application from the ServiceNow Store.
The discovery pattern uses a set of SNMP calls to find the Palo Alto Networks firewalls. Discovery uses the pattern to run horizontal discovery.

## Request apps on the Store {#palo-alto-fw-discovery__section_crv_1zm_slb}

Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/r/store-release-notes/sn-store-release-notes.html).{#palo-alto-fw-discovery__inline-send-to-store}

## Palo Alto Networks firewall data model {#palo-alto-fw-discovery__section_data_model}

The Next-Generation Palo Alto Firewall pattern introduces the following CI class that extends an existing CMDB class.  
{#palo-alto-fw-discovery__table_extends_palo_alto__entry__2}

| CI class | Extends from |
|-|-|
| Palo Alto Firewall Device \[cmdb_ci_firewall_device_palo_alto\] | Firewall Device \[cmdb_ci_firewall_device\] |
[Table 1. CI class introduced by this pattern]

{#palo-alto-fw-discovery__table_extends_palo_alto}

## Prerequisites {#palo-alto-fw-discovery__section_jtr_bzm_slb}

* Ensure that your network firewall device has SNMP access.
* On the ServiceNow instance, configure SNMP credentials. For more information, see [SNMP credentials](https://www.servicenow.com/docs/access?context=c_SNMPCredentials&version=australia&pubname=australia-platform-security&ft:locale=en-US).
* Add the SNMP system OID record for the Palo Alto Networks device to the ServiceNow instance. Update the following:
  * Classifier: Palo Alto Firewall
  * Class: Palo Alto Firewall Device
  {#palo-alto-fw-discovery__ul_pxv_3zm_slb}
* Deploy the pattern as follows:
  1. Download and install [Firewall extension classes](https://www.servicenow.com/docs/access?context=cmdb-ci-class-models-fw&version=australia&pubname=australia-servicenow-platform&ft:locale=en-US) from the ServiceNow Store. The app adds the new CMDB classes required for network firewall discovery.
  2. Download and install the discovery pattern from the ServiceNow Store.
  3. Sync the pattern with the appropriate MID Server.
  {#palo-alto-fw-discovery__ol_qmp_kzm_slb}
{#palo-alto-fw-discovery__ul_vfj_dzm_slb}

## Data collected by Discovery during horizontal discovery {#palo-alto-fw-discovery__section_vtj_4zm_slb}

Discovery populates the data in the CMDB when running the Next-Generation Palo Alto Firewall Pattern.  
{#palo-alto-fw-discovery__table_hrc_kh1_m2c__entry__2}

| Field | Description |
|-|-|
| IP Address \[ip_address\] | IP address of the Palo Alto device. |
| Serial number \[serial_number\] | Serial number of the Palo Alto device. |
| Fully qualified domain name \[fqdn\] | Fully qualified domain name (FQDN) of the Palo Alto device. |
| Manufacturer \[manufacturer\] | Palo Alto device manufacturer. |
| Model ID \[model_id\] | Model ID of the Palo Alto device. |
| Operational status \[operational_status\] | Indicates whether the Palo Alto device is in active state. |
| Hardware OS \[hardware_os\] | OS running on the hardware. |
| Hardware OS Version \[hardware_os_version\] | OS version running on the hardware. |
| Description \[short_description\] | Short description of the Palo Alto device. |
| Firmware version \[firmware_version\] | Palo Alto device firmware version. |
[Table 2. Palo Alto Firewall Device \[cmdb_ci_firewall_device_palo_alto\]]

{#palo-alto-fw-discovery__table_hrc_kh1_m2c}  
{#palo-alto-fw-discovery__table_zxb_5g1_m2c__entry__2}

| Field | Description |
|-|-|
| IP Address \[ip_address\] | IP address of the network adapter. |
| Alias \[alias\] | The user-assigned name for the network adapter. |
| Netmask \[netmask\] | Netmask of the network adapter. |
| MAC address \[mac_address\] | MAC address of the network adapter. |
| Name \[name\] | Name of the network adapter. |
| Configuration Item \[cmdb_ci\] | References the Palo Alto Firewall Device \[cmdb_ci_firewall_device_palo_alto\] table. |
[Table 3. Network Adapter \[cmdb_ci_network_adapter\]]

{#palo-alto-fw-discovery__table_zxb_5g1_m2c}  
{#palo-alto-fw-discovery__table_lh4_ch1_m2c__entry__2}

| Field | Description |
|-|-|
| IP Address \[ip_address\] | IP address of the Palo Alto firewall. |
| Netmask \[netmask\] | Netmask of the Palo Alto firewall. |
| Nic \[nic\] | References the Network Adapter \[cmdb_ci_network_adapter\] table. |
[Table 4. IP Address \[cmdb_ci_ip_address\]]

{#palo-alto-fw-discovery__table_lh4_ch1_m2c}  
{#palo-alto-fw-discovery__table_vpg_w2y_m2c__entry__2}

| Field | Description |
|-|-|
| Name \[name\] | Domain Name System (DNS) name of the Palo Alto firewall device. |
| IP Address \[ip_address\] | Host IP address. |
[Table 5. DNS Name \[cmdb_ci_dns_name\]]

{#palo-alto-fw-discovery__table_vpg_w2y_m2c}

## CI relationships {#palo-alto-fw-discovery__section_ond_31n_slb}

The Next-Generation Palo Alto Firewall pattern creates the following relationships and references to support Palo Alto Networks firewall discovery. References link to records in other tables and don't appear in the CI Relationship \[cmdb_rel_ci\] table.  
{#palo-alto-fw-discovery__table_ihs_gfy_m2c__entry__3}

| CI | Relationship | CI |
|-|-|-|
| Palo Alto Firewall Device \[cmdb_ci_firewall_device_palo_alto\] | Owns::Owned by | Network Adapter \[cmdb_ci_network_adapter\] |
| Palo Alto Firewall Device \[cmdb_ci_firewall_device_palo_alto\] | Owns::Owned by | IP Address \[cmdb_ci_ip_address\] |
| Palo Alto Firewall Device \[cmdb_ci_firewall_device_palo_alto\] | Uses::Used by | Router Interface \[dscy_router_interface\] |
| Network Adapter \[cmdb_ci_network_adapter\] | Owns::Owned by | IP Address \[cmdb_ci_ip_address\] |
[Table 6. CI relationships]

{#palo-alto-fw-discovery__table_ihs_gfy_m2c}  
{#palo-alto-fw-discovery__table_ci_references_palo_alto__entry__3}

| CI | Field | Referenced CI |
|-|-|-|
| Serial Number \[cmdb_serial_number\] | Configuration item \[configuration_item\] | Palo Alto Firewall Device \[cmdb_ci_firewall_device_palo_alto\] |
| Network Adapter \[cmdb_ci_network_adapter\] | Configuration Item \[cmdb_ci\] | Palo Alto Firewall Device \[cmdb_ci_firewall_device_palo_alto\] |
| Router Interface \[dscy_router_interface\] | Configuration Item \[cmdb_ci\] | Palo Alto Firewall Device \[cmdb_ci_firewall_device_palo_alto\] |
| IP Address \[cmdb_ci_ip_address\] | Nic \[nic\] | Network Adapter \[cmdb_ci_network_adapter\] |
[Table 7. CI references]

{#palo-alto-fw-discovery__table_ci_references_palo_alto}