topic Re: Firewall management IP. in General Topics

Firewall management IP.

Netwerx — Mon, 10 Feb 2014 18:28:30 GMT

Can the ip address for the firewall web interface be reached through a virtual wire, or is it required that a https management profile be assigned to a layer 2 or 3 interface?

Re: Firewall management IP.

HULK — Mon, 10 Feb 2014 20:34:11 GMT

Hello Sir,

You can't point the service route through a V-wire interface. You need to connect the management interface to a gateway device or configure an L3 interface ( or subinterface) on the firewall with management profile.

Thanks

Re: Firewall management IP.

sraghunandan — Tue, 11 Feb 2014 19:40:33 GMT

IP address of the firewalls management can be reached via virtual wire if the l3 device connected to one end of the virtual wire connects to the management interface through the vwire , else you can manage the device by configuring an interface management profile on a l3 interface.

Re: Firewall management IP.

ericgearhart — Tue, 11 Feb 2014 20:19:44 GMT

sraghunandan - just an observation, that's an extremely weird use case in my opinion. If you were going to do such a thing wouldn't you just use a tap interface, and a separate management interface?

Plugging Vwire back around and into the firewall management port would be extremely weird, to me. Not a best practice.

Re: Firewall management IP.

sraghunandan — Tue, 11 Feb 2014 20:22:03 GMT

Yes it is a weird use case and I have't seen anybody use it, I just provided a solution based on what he had requested.As you mentioned I would setup a separate management interface and instead of having it go through the vwire.

Re: Firewall management IP.

ericgearhart — Wed, 12 Feb 2014 20:56:01 GMT

Right, no worries. I just wanted to emphasize how weird it looked in my head

Re: Firewall management IP.

pulukas — Sun, 16 Feb 2014 18:22:01 GMT

I agree with Eric here, bending over backwards to get a mgmt connection to run through a v-wire is just weird.

The correct answer is what Hulk notes above. If you use v-wire you need to configure a mgmt port or L3 interface separate from the v-wire in order to connect to and manage the Palo Alto.