Access to Web-GUI (on MGMT-Port) via IPSec-Tunnel from external network

[GuidoKramer]

Hey everyone,

I have the following active-passive-HA-scenario:

ethernet1/1: External Interface (vpn termination point)

ethernet1/2: Internal Interface

MGMT: Management-Interface

HA1: HA

HA2: HA

For administrative and monitoring purposes I need access from an external network to the WEB-GUI of both firewall-systems. Because of active-passive-HA, just one firewall is available at the same time. So I thought: Is it possible to establish a IPSec-Tunnel between two firewall to get access to the WEB-GUI:

The ipsec tunnel works fine and I can see hits on the security policy which should allow the traffic from external network to the Management-Interface of the palo alto firewall. But the access via https does not work. 😞

My questions:

- Is it possible to get access from external network via ipsec-tunnel to the Management-Interface of a Palo Alto Firewall?

- Are there other ways to get access from external network via ipsec-tunnel to the WEB-GUI of both firewall-systems?

Thanks in advance

[kiwi]

Hi @GuidoKramer ,

Yes it is possible.

Check out the following page for best practices for securing admin access and for remote access to the management network :

best-practices-for-securing-administrative-access

Cheers !

-Kiwi.

[GuidoKramer]

OK, I added a new security policy with the information mentioned on the page "Best Practices for Securing Administrative Access". When I tried to initiate a session with my web browser I can see that the hit count of this policy raises; but still the login prompt does not appear in the browser.

Of course, the network from which I initiate the connection was added to "Device --> Setup --> Interface --> Management --> Permitted IP Addresses".

Or do I have to connect via GlobalProtect?

[kiwi]

Hi,

I don't know how you're routing is set up.

I say this because the mgmt port is usually out-of-band.

Alternatives:

You can use a bastion host as explained in the best practices link

You can configure a mgmt profile on your tunnel interface (if it's numbered) or use a mgmt profile on a loopback interface.

Cheers !

-Kiwi.

[SteveCantwell]

Resolve this a few ways

1) GP is best/secure, so use that if you can.

2) Clientless VPN (connect to portal of FW on the GUI page, and have a widget to web into the mgmt IP of 2nd FW

3) Port forwarding of a NAT'd address, to the mgmt IP of the 2nd FW.

Untrust --> Untrust --> publicIPofSomething -- (port XXYZ)  Xlate to Mgmt-IPof2ndFW. on 443

Now, create a security policy that allow access from Untrust to (InternalZone) publicIPofSomething (port XXYZ)

Those are a few ways to do this.  Some secure, others just engineering a solution.  😛