topic Re: Management access for permitted IPs in General Topics

Management access for permitted IPs

josggf — Fri, 16 Nov 2018 00:29:46 GMT

i am trying to add 10/8 as premitted IP subnet in mgmt interface but it seems to not work? anyone else has experienced this?

Re: Management access for permitted IPs

Mick_Ball — Fri, 16 Nov 2018 07:20:19 GMT

I do not restrict management to specific ip’s but it’s my understanding that this option is for host addresses, not entire ranges.

Re: Management access for permitted IPs

josggf — Fri, 16 Nov 2018 07:25:53 GMT

I will recheck but I think it works for a /24

Re: Management access for permitted IPs

OtakarKlier — Fri, 16 Nov 2018 15:34:30 GMT

Hello,

One approach is to use the PAN itself to secure the management interface. Meaning you put the management interface into a zone that is managed by the PAN so then you can use all sorts of different options to secure the management interface, i.e. source/destination IP, zone, user-id, etc.

Cheers!

Re: Management access for permitted IPs

Mick_Ball — Fri, 16 Nov 2018 16:37:40 GMT

yes good point @OtakarKlier but our policies only permit out of band management.

perhaps @josggf has the management interface connected to the user or trusted LAN and therefore your suggestion would be best.

Re: Management access for permitted IPs

BPry — Fri, 16 Nov 2018 22:41:13 GMT

@josggf,

What's the point of even putting in permitted IPs if you're enabling an entire /8 network? Regardless, 8.1.* and 8.0.* will allow you to do this perfectly fine without complaint, are you trying to actually include '10/8' or '10.0.0.0/8', because it would need to be the second option.