changing a gateway's management IP?

JimMcGrady — Thu, 07 Oct 2021 07:31:36 GMT

If i have a gateway managed via Panorama, what would be the steps needed if that gateway's management IP needs to change?

The actual change of IP is straight forward. But then what about the changes needed between Panorama and that gateway?

Re: changing a gateway's management IP?

PavelK — Fri, 08 Oct 2021 02:46:25 GMT

Thank you for posting question @JimMcGrady

I tried to simulate this use case with one of the Firewall that is currently not in use. Below are my findings:

When I tried to change Firewalls management interface IP address locally on the Firewall, after I committed changes, the Panorama's Automatic Connection Recovery has kicked in and rolled back the change to the original IP address.

On the second attempt, I disabled the Panorama's Automatic Connection Recovery feature from: Device > Setup > Management > Panorama Settings > [De-select] Enable automated commit recovery, then I tried again to change IP address and after commit was completed it worked well. After approximately 2 minutes, I have seen the Firewall in Panorama with new management IP address.

You might have to restart management process on Firewall to restart log sending if you are using Panorama also for log collection. After this change, I have not seen any issue with Firewalls Device Group / Template Stack. Overall it was smooth.

Outside of Panorama, if you change Firewalls management IP address you might have to reflect this change in your monitoring system, tacacs/radius server, syslog server,...etc.

If my test has not covered the issue you are trying to address or you are looking into something else, let me know.

Kind Regards

Pavel

topic Re: changing a gateway's management IP? in Panorama Discussions

changing a gateway's management IP?

Re: changing a gateway's management IP?