topic Re: Using AUX port as management port in Next-Generation Firewall Discussions

Using AUX port as management port

grenzi — Mon, 17 Jul 2023 20:20:10 GMT

Hello everybody,

I'm configuring a pair of PA5250 in active/standby high availability mode. Since we have no RJ-45 ports on our switches, I would like to use one of the AUX ports as the management port in place of the default MGT RJ-45 port. We are using 10 Gbps SFP+ transceiver (long range, single mode fiber), and the AUX-1 configured as the HA1 port is working fine. The AUX-2 port, not configured as a HA port, has its own IP address, netmask and gateway but does not come up. The "show interface aux-2" command shows only the configured gateway, while for the IP address and netmask it shows "unknown". This happens on both firewalls in the HA pair.

Am I missing something to configure the AUX-2 as a management interface? What about the heartbeat backup when the RJ-45 MGT port is not plugged in?

The installed PAN-OS is 10.1.3, I will upgrade to 10.1.10-h1 tomorrow to see if this solve the issue.

Thank you in advance.

Re: Using AUX port as management port

TomYoung — Tue, 18 Jul 2023 17:51:49 GMT

Hi @grenzi ,

I am curious. I have a customer with a PA-5220 w/ PAN-OS 9.1, and the aux interfaces do not show up under Network > Interfaces. They show up under Device > Setup > Interface. Do you see them under both or just one?

Thanks,

Tom

Re: Using AUX port as management port

grenzi — Wed, 19 Jul 2023 06:40:55 GMT

Hi, this is normal because AUX-1 and AUX-2 belong to the management plane, so they are not listed in the dataplane interface tab.

Anyway it seems I solved my issue; the problem was at the physical layer (inverted fiber cables), but since we found RJ45 SFPs to attach the dedicated MGT interfaces to the switch, the AUX-2 port has been reconfigured as the HA1-backup interface.

Re: Using AUX port as management port

AaronAxvig — Tue, 01 Aug 2023 18:10:43 GMT

@grenzi wrote:

What about the heartbeat backup when the RJ-45 MGT port is not plugged in?

It seems like you could still have the heartbeat talking between the two firewalls on the MGMT port if you directly cabled them to each other. What is to say that you NEED to have a switch between them? Possible roadblock when it comes to default gateway settings though...you would have to configure each interface with no default gateway, a bogus default gateway, or one of the two firewalls as the default gateway I suppose.