topic Re: Remote Access on passive node of firewall ha cluster in General Topics

Remote Access on passive node of firewall ha cluster

GuidoKramer — Fri, 19 Jul 2019 10:55:52 GMT

Hello all,

I am currently configuring an HA cluster (active / passive) with the following configuration:

Primary (active) box: PA-820
ethernet1 / 1: 1.1.1.1/29 (external interface)
ethernet1 / 2: 192.168.0.1/24 (internal interface)
MGMT: 192.168.50.251/25 (Management interface)

Secondary (passive) box: PA-820
ethernet1 / 1: No IP address, as this is the secondary (passive) box.
ethernet1 / 2: No IP address, as this is the secondary (passive) box.
MGMT: 192.168.50.252/25 (Management interface)

The two firewall systems are located at the customer, so I have no physical access to the MGMT interface. Nevertheless, I would like to be able to administrate both (!!!) firewall systems remotely. Previous attempts to access the management port (MGMT) via a NAT or similar have failed.

What works is access to the primary system via VPN. The internal interface (ethernet1 / 2) is in the list of protected networks and the interface itself has been assigned the management role

What options do I have left?

An active / active HA configuration is eliminated because DHCP is needed on the firewall.

Thanks for your help!

Regards,

Guido

Re: Remote Access on passive node of firewall ha cluster

reaper — Fri, 19 Jul 2019 12:05:37 GMT

You can set up Panorama to manage multiple systems from a single entity, all managed systems connect into Panorama, so no need for access to the network at all

An alternative 'industry best practice' method would be to set up a bastion host that is dual homed so you can VPN into the network and hop onto that station to perform admin on both firewalls

Re: Remote Access on passive node of firewall ha cluster

aleksandar.astardzhiev — Mon, 22 Jul 2019 07:58:54 GMT

@reaperam I missing something or the Panorama is not valid option here?

Even it is cluster setup (with config synchronization) Panorama needs to have access to both members.

Dedicated Mgmt interface is not reachable so the Panorama cannot use that

It is active-passive cluster so you cannot use service route through one of the dataplane interfaces.

Re: Remote Access on passive node of firewall ha cluster

reaper — Mon, 22 Jul 2019 10:31:03 GMT

Ideally you'd set the panorama up so it has an "in" to the oob network Either set it up locally, via a bastion proxy or via a segmented dataplane interface (via the active member)

Re: Remote Access on passive node of firewall ha cluster

OtakarKlier — Mon, 22 Jul 2019 21:45:47 GMT

Hello,

What about a VPN Tunnel to the HA pair or use Global Protect to connect?

Regards,