topic Re: Management Interface Permitted IP Addresses & other devices in General Topics

Management Interface Permitted IP Addresses & other devices

stevenkadish — Fri, 17 Apr 2020 19:25:08 GMT

Hello all,

Our PAN-OS Management Interface Permitted IP Addresses (on both Panorama and firewalls, version 8.14) contain IPs for the firewalls and both members of the Panorama cluster. These weren't set up by me and I'm wondering if that's necessary. I have read an article that said that that device configs, log retrieval, etc. are managed over that interface. So, does every Panorama and firewall have to have every other Panorama and firewall in its access list?

Also, is there a trick anyone knows of to make it easy to copy those access lists from device to device?

Any help is appreciated.

Thanks in advance,

- Steve

Re: Management Interface Permitted IP Addresses & other devices

BPry — Fri, 17 Apr 2020 19:38:43 GMT

@stevenkadish,

This depends on how you actually have things configured; a lot of the time you wouldn't need to add all of the other firewalls into the permitted-ip list on the other firewalls. That being said, they could be using user-id redistribution or using it as a backup management access solution or something like that.

The easiest answer really is that managing this through the API or the XML is going to be the easiest solution I've found for managing this. It's easy enough to do in the API for each firewall, or if you're working in the XML configuration file already it's extremely easy.

Re: Management Interface Permitted IP Addresses & other devices

stevenkadish — Fri, 17 Apr 2020 21:17:53 GMT

Thanks, @BPry . From the configuration I've done since I got your response, I haven't had any problems if I omit the firewalls from the access lists. I'm using the XML files to configure them, which is certainly easier!