Remote site management to be managed with Panorama?

jsalmans — Mon, 31 Jul 2023 21:16:32 GMT

I'm looking at deploying some PAN-440 firewalls and wanted to get some advice as this is one of the first remote sites I've done with Palo. My intention was to build an IPSEC bridge between the remote site and our on-prem firewalls in order to pipe all of the remote site's traffic to us. That would allow us to control internet access and use our on-prem subscriptions for cybersecurity as well as enable the remote site to access our wireless controller, VoIP system, etc.

Looking at deployment options, it seems like ZTP might be good for this so I'm reading up on that.

My question: I'm assuming the management that ZTP sets up would NOT go across the IPSEC tunnel and that it would be best practice to leave it that way? Theoretically, if we create firewall policy that only allows the static IPs on each side to communicate with each other then this would allow troubleshooting if the tunnel fails for some reason. I must admit that I'm a little hesitant to create an inbound NAT and security policy pointing to Panorama for security but, again, this could be mitigated by only allowing the remote static IP and it appears to be necessary for ZTP setup.

Thanks!

topic Remote site management to be managed with Panorama? in Panorama Discussions

Remote site management to be managed with Panorama?