topic Re: FIPS Enabled Panorama - Change Management IP in Panorama Discussions

FIPS Enabled Panorama - Change Management IP

Roger_K — Wed, 16 Jun 2021 14:19:10 GMT

Hello,

Is there a best practice, for changing the management IP on a FIPS enabled Panorama M-100?

I have a FIPs enabled Panorama M-100. It is configured with a management interface for administrative functions on one network. It is configured with another interface on a different network to communicate with managed firewalls (Layer 2 Adjacent). I need to change the management IP. Normally, I would do this through the console on other networking devices. However, it appears that for FIPS, Palo Alto disables the console. I attempted to SSH to the non management interface with no luck. I assume this is by design. My concern is changing the IP on a production asset and making an error during change and losing connectivity.

Thanks

Re: FIPS Enabled Panorama - Change Management IP

S.Cantwell — Thu, 17 Jun 2021 14:48:09 GMT

Hello

Let's take a look at a FW under Panorama control

in the 9.1.x software, there was a feature to enable automated commit recovery, to rollback a config if it disconnects from the Panorama, so your concern is valid, and PANW has a way to resolve the situation.

Re: FIPS Enabled Panorama - Change Management IP

Roger_K — Fri, 25 Jun 2021 16:13:32 GMT

Thanks for the response. Unfortunately, our devices are running version 8.1. Also, my concern is not losing connections between FW and Panorama, as that is not the interface IP I need to change. I need to change the IP on the management interface for Panorama. We have a second interface that serves as the connection between Panorma and the managed firewalls.