topic Re: Management Interface in General Topics

Management Interface

Huddlebuy — Wed, 09 Sep 2015 10:40:37 GMT

Hi, Is it a good idea to connect the mgmt interface directly to wan ? or should it only be accessible locally and via an access server for remote management ?

Re: Management Interface

santonic — Wed, 09 Sep 2015 10:47:43 GMT

It's a very bad idea.

If you really want mgmt access directly from WAN; put management profile on some other L3 interface connected to WAN and restrict access within management profile and with firewall rules. This way you can also put security profiles on this rule, zone protection etc.

Re: Management Interface

Ben-W — Wed, 09 Sep 2015 13:47:32 GMT

Hi Huddlebuy,

Personally I like to setup GlobalProtect for businesses which require remote management to the PA firewalls.. As you get a single free portal and gateway license prior to version 7 (Portal license is free).

Setup GlobalProtect and enable HTTPS and/or SSH in an interface management profile and add to the GlobalProtect Tunnel Interface.

Hope this helps.

regards,

Ben

Re: Management Interface

Brandon_Wertz — Wed, 09 Sep 2015 18:35:20 GMT

I'd go a step further and restrict access for a specific set of IPs or Networks.

Re: Management Interface

santonic — Mon, 14 Sep 2015 07:33:43 GMT

Yeah, for normal everyday access to firewall VPN client and accessing mgmt interface in LAN is the way to go. But access directly from WAN is typcially needed when something is wrong with the firewall. In that case GP might not be working and you won't be able to use such access. Then a mgmt access to WAN is needed but should only be allowed from a few IPs.

Re: Management Interface

Huddlebuy — Mon, 14 Sep 2015 17:14:49 GMT

Thanks guys; will be configuring it behind a firewall on the OOBM link.