topic Panorama device management via loopback in General Topics

Panorama device management via loopback

Baddogsettle — Wed, 29 Jul 2020 18:40:43 GMT

I have remote PA firewalls deployed with IPSec tunnels back to our data center firewalls. The remote management interface is not used; I created a loopback and configured all service route items to use the loopback. However, in Panorama Managed Device Summary, it still shows the remote management interface IP (which is not connected to anything).

How can I change to Panorama shows the loopback IP in Device Management?

Re: Panorama device management via loopback

RamprakashRT — Fri, 31 Jul 2020 16:07:00 GMT

Hi ,

Please make sure that loopback IP is reachable to Panorma on required ports and Viceversa.

If NAT is involved make sure it is bidirectional NAT as communication between Panorma and firewall is bidirectional.

Thanks,

Ram

Re: Panorama device management via loopback

Remo — Sat, 01 Aug 2020 08:22:59 GMT

Hi @Baddogsettle

This isn't possible. In panorama you will always see the management IP. Specially in case of an active passive HA cluster you would have the same loopback interface and IP ond both firewalls, then it would be somehow wrong to show both firewalls with the same loopback IP in panorama (besides the fact, that in this case it simply wouldn't really work).

@RamprakashRT You are right, the communication is bidirectional, but the connection is initiated from the firewall towards panorama and not otherwise. Over this connection coming from the firewall, panorama is then able to connect back to the firewall (for pushing updates, context switch to the firewall, ...)

Re: Panorama device management via loopback

RamprakashRT — Sun, 02 Aug 2020 10:25:41 GMT

Hi @Remo

Thanks for the clarification , got it now.

Thanks,

Ram