topic Re: How can we manage the Firewalls while Panorama is out of service? in General Topics

How can we manage the Firewalls while Panorama is out of service?

mmcastr — Wed, 24 Jan 2018 15:54:59 GMT

In a scenario with many groups of firewall's centrally managed by Panorama.
The Panorama is running in a appliance without HA.

What we should do when Panorama is outage by a problem and we have to do any change in the Firewall Policies?

Best Regards,

Marcelo Castro

Re: How can we manage the Firewalls while Panorama is out of service?

jvalentine — Wed, 24 Jan 2018 16:57:41 GMT

Here's what I would recommend:

1.) use redundant Panoramas so they're both not out of service at the same time. Or...

2.) only create "post rules" within Panorama. Then, if Panorama is out of service, you can always connect directly to the firewall and make emergency changes that will override any of the Panorama-pushed post-rules.

Re: How can we manage the Firewalls while Panorama is out of service?

bspilde — Wed, 24 Jan 2018 17:02:14 GMT

Agreed. Those pre-rules will put you in a bind every time!

Local overrides on other configuration options on the firewall work as great as well if Panorama has no access or is down.

Re: How can we manage the Firewalls while Panorama is out of service?

mmcastr — Thu, 01 Feb 2018 16:04:25 GMT

@jvalentine
There is no budget to follow suggestion #1.
As I was reading about it we have a lot of work to do. We have so many pre rules to migrate to post rules.

Thanks for this tip.

Re: How can we manage the Firewalls while Panorama is out of service?

BPry — Thu, 01 Feb 2018 12:54:50 GMT

@mmcastr,

If you are comfortable with working with the XML config directly converting your pre-rules to post-rules would be as simple as copy and pasting them into the proper areas. That would be my recommended way of doing this.

Re: How can we manage the Firewalls while Panorama is out of service?

mmcastr — Thu, 01 Feb 2018 16:10:48 GMT

I'm not comfortable with XML config yet but I'll study your suggestion.
Thanks for this smart tip @BPry

Re: How can we manage the Firewalls while Panorama is out of service?

BrianRa — Thu, 01 Feb 2018 16:34:04 GMT

Use this with caution. I would decide how important the rule changes are in the immediate.

https://live.paloaltonetworks.com/t5/Management-Articles/Disable-Panorama-Policy-and-Objects-Disable-Device-and-Network/ta-p/76539

Once this is done it can be a pain to pull back into Panorama, we have had to do this for a site we were bringing online once and also when a site was no longer able to connect due to ISP changes. Both times there were unique challenges bringing it back into Panorama.

Brian

Company note: we chose to run Panorama for configurations as a VM, we maintain a backup copy of it at a DR site incase there is an emergency/failure.