topic Re: Does the firewall need to have Panorama IPs in its permitted IP list for MGMT interface? in General Topics

Does the firewall need to have Panorama IPs in its permitted IP list for MGMT interface?

nahiar — Sun, 04 Oct 2026 23:40:40 GMT

Does the firewall need to have Panorama IPs in its permitted IP list for MGMT interface?

I tested and it seems I only need Panorama to allow FW IP. But from the article below for MGMT interface profile it mentions adding Panorama IP is required.

https://live.paloaltonetworks.com/t5/general-articles/why-it-s-essential-to-secure-your-management-i...

Re: Does the firewall need to have Panorama IPs in its permitted IP list for MGMT interface?

PavelK — Mon, 05 Oct 2026 06:52:37 GMT

Hello @nahiar

I do not believe it is required. Firewall initiates connection to Panorama. Not other way around, therefore Panorama's IP address does not have to be on the management interface permitted list. The link you shared seems to be cut off. Could you please share the complete link?

Thank you and Regards

Pavel

Re: Does the firewall need to have Panorama IPs in its permitted IP list for MGMT interface?

nahiar — Mon, 05 Oct 2026 07:11:44 GMT

Hi @PavelK,

It's item 3b in the link below

https://live.paloaltonetworks.com/t5/general-articles/why-it-s-essential-to-secure-your-management-interface/ta-p/1001286

Re: Does the firewall need to have Panorama IPs in its permitted IP list for MGMT interface?

MP18 — Mon, 05 Oct 2026 14:56:10 GMT

@nahiar as far as I know Panorama needs firewall IP in the MGMT Interface allowed list.

Firewall MGMT Interface does not need Panorama IP in the allowed list.

Regards

Re: Does the firewall need to have Panorama IPs in its permitted IP list for MGMT interface?

PavelK — Mon, 05 Oct 2026 22:06:40 GMT

Hello @nahiar

thank you for reply.

From my point of view the statement in that article is misleading. I will ask internally whether this post can be reviewed and corrected.

All the communication is initiated by Firewall, therefore it is not necessary to include Panorama IP address in the management profile. There might have been exception in PAN-OS 7.1 and earlier where deployment updates were initiated by Panorama: Ports Used for Panorama, however in current PAN-OS releases it is no longer case.

If Panorama has Permitted IP address list configured of course Firewalls' IP addresses have to be included: Managed Devices Unable to Establish Connections to Panorama after Configuring Permitted IP Addresses.

Kind Regards

Pavel