topic Re: Question about Management Interface in General Topics

Question about Management Interface

james_savage — Mon, 23 Jan 2023 19:28:30 GMT

Hello All,

My current management IP is set to a private IP and is up and pingable from the PALO ALTO command line. How ever I cannot log onto the management IP via WEB GUI...

Does the management interface correlate to the physical management port on the palo or is there someway to connect to the management IP from a different network? Or can you connect to a passive palo from the web interface somehow? I am trying to upgrade an HA pair with no downtime but I am not finding a way to connect to the PASSIVE unit via the web....

Re: Question about Management Interface

Raido_Rattameister — Mon, 23 Jan 2023 19:53:52 GMT

Management interface correlates to physical port on Palo.

What do you see in traffic log when you try to access management IP?

Is this traffic permitted in security policy?

Does management interface have default gateway configured?

Do you have "permitted IP addresses" configured on management interface?

Re: Question about Management Interface

james_savage — Mon, 23 Jan 2023 20:11:35 GMT

There is no cable plugged into these ports yet the prior sysadmin has the management interfaced staticly addressed and the address is pingable only by the Palo itself.... is this setup pointless and I need to set up traditional cabled out of band management? Or is there some internal passthrough on the management IP?

Re: Question about Management Interface

Raido_Rattameister — Mon, 23 Jan 2023 20:17:05 GMT

There is no internal passthrough.

Either connect cable to mgmt port (preferred option) or configure some (preferably internal) dataplane interface with interface management profile (https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/configure-interfaces/use-interface-management-profiles-to-restrict-access).

Management interface cable is preferred because Palo separates dataplane and management plane.

You can access Palo through physical mgmt port even if firewall dataplane is overloaded.

Re: Question about Management Interface

james_savage — Mon, 23 Jan 2023 20:18:23 GMT

Is this the only way to connect to a passive UNIT in a HA pair? Is via the management interface?

Re: Question about Management Interface

Raido_Rattameister — Tue, 24 Jan 2023 00:02:38 GMT

Yes only way to access passive is through mgmt.