topic Re: Panorama location best practice in General Topics

Panorama location best practice

Retired Member — Fri, 27 Jan 2017 10:58:04 GMT

I have deployed Panorama in our LAN and plan to manage a global install. Now I realized that remote firewalls cannot reach it until they have their VPN setup (which I prefer to do using Panorama too).

What is the best practice to solve this? Should Panorama reside in a DMZ and have managed firewalls communicate over the Internet to a public IP?

Re: Panorama location best practice

pulukas — Sat, 28 Jan 2017 19:23:24 GMT

I've not seen a recomendation in the PA documents but I have done this type of management using both methods. Personally I prefer the public address connect method. I like to setup and manage the VPN as you mention but also if there are issues with the VPN then mgmt is still available as long as the internet link itself is up.

You identify the advantages and disadvantages for the main features. If you decide to go with the public address management be sure to setup specific rules that only permit access to the branch devices from the Panorama NAT address. Make sure the surface area opened is the minimum needed.

Re: Panorama location best practice

Retired Member — Sat, 28 Jan 2017 21:34:45 GMT

Thanks

Re: Panorama location best practice

Retired Member — Sat, 04 Feb 2017 09:44:38 GMT

A quick follow up. I decided to leave it in the LAN despite the little downsides. I realized that it could potentially store sensetive data that should not be exposed in a DMZ kind of a network segement. Also, it would make integration with internal DNS, User-ID agents, etc. easier.

Just in case this helps someone...

Re: Panorama location best practice

pulukas — Sat, 04 Feb 2017 12:07:15 GMT

All good reasons for the internal side connections.

You have a good handle on the benefits each way. I'm sure your deployment will go well.