topic Re: Panorama to VM Firewall in General Topics

Panorama to VM Firewall

Sanjay_Ramaiah — Thu, 04 Jan 2024 10:15:19 GMT

Hi Team,

Is it mandatory to configure the Management Interface on firewall if we plan to manage the firewalls via Panorama?

I am trying to setup connection from the firewall to manage it over the Panorama but unable to get the connection.

Even TAC was saying it is necessary to have Mgmt interface if we manage it over Panorama. But in Service Policy i can see an option for Panorama to change the interface other than default. So it should work is what i think. Please suggest.

Regards

Sanjay S

Re: Panorama to VM Firewall

PavelK — Thu, 04 Jan 2024 12:43:14 GMT

Hello @Sanjay_Ramaiah

I had a few Firewalls where circumstances forced me to use data plane interface instead of management interface to register Firewall to Panorama, so I can confirm from my own experience that it is possible. I do not recall memory to do anything special than making a change in service route to use data plane interface. Can you see any clue any traffic logs?

Kind Regards

Pavel

Re: Panorama to VM Firewall

TomYoung — Thu, 04 Jan 2024 14:29:00 GMT

Hi @PavelK ,

That's good to know. Thank you! Since the management traffic is always initiated by the NGFW, do we even need an Interface Management Profile?

Thanks again,

Tom

Re: Panorama to VM Firewall

PavelK — Thu, 04 Jan 2024 21:14:42 GMT

Hi @TomYoung

to be honest I never tried this without management profile being attached to an interface, however I think you are right. If Firewall is completely managed by Panorama it should work without it.

Kind Regards

Pavel

Re: Panorama to VM Firewall

Sanjay_Ramaiah — Wed, 10 Jan 2024 08:02:25 GMT

Thanks All, I am still working on this.

Issue still not resolved but TAC says that it is must to have Mgmt interface configured. But i dont find any document says that it is must to configure the Mgmt interface. Will keep this chain updated.

Regards,

Sanjay S

Re: Panorama to VM Firewall

TomYoung — Wed, 10 Jan 2024 12:37:35 GMT

Hi @Sanjay_Ramaiah ,

Did you change ALL the service routes to the data plane interface?

Thanks,

Tom

Re: Panorama to VM Firewall

Sanjay_Ramaiah — Thu, 18 Jan 2024 10:48:29 GMT

Hi Tom,

No, not all the service routes but only the DNS, Radius and now Panorama. Whichever is required only those i changed.

Will that cause an issue at all?

Regards,

Sanjay S

Re: Panorama to VM Firewall

TomYoung — Thu, 18 Jan 2024 13:43:02 GMT

Hi @Sanjay_Ramaiah ,

Since you do not plan to use the management interface, I will configure all the service routes the same. The service routes you listed should be all you need, but it is not working. Let's see if this makes a difference.

Thanks,

Tom