topic PA OOB Managment Interface question in General Topics

PA OOB Managment Interface question

supruzer — Mon, 28 Dec 2020 20:42:51 GMT

How can I get PAN updates via the MGMT Interface if its on an isolated network inside my organization. NOTE: Its not on the internal zone. The route is working as i can see my packets leaving via egress when i ping from the host connected to the MGMT port. I want to avoid using Service route configuration via the external facing interface. Cheers!

Re: PA OOB Managment Interface question

BPry — Tue, 29 Dec 2020 04:09:23 GMT

@supruzer,

You either have the management interface get be allowed internet access to pull updates, create a service route, or manually upload and apply updates. That's really the only three options you have as far as updates go.

Re: PA OOB Managment Interface question

reaper — Tue, 29 Dec 2020 10:58:50 GMT

@supruzerin Device > Setup > Services > Service Route Configuration you can addcustomized interface configuration per service so those connections go out of a dataplane interface instead of the management interface. This comes in handy if you want to pull in dynamic updates while your management interface has no route to the internet.

Make sure that you also account for DNS, as the firewall will need to resolve updates.paloaltonetworks.com. You may need to add a service route for DNS as well

Also set up appropriate security rules so the connections are allowed to go out