by default a Firewall is using management interface for this communication: Panorama and NTP/License Check
If you want to change that behavior, you can configure it by using service route. Here is corresponding KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGJCA0 From service route setting you can separate Panorama/Panorama Log Forwarding to use one dedicated data plane interface and for NTP and Palo Alto Networks Services (I think this one is used for license check) to use different dedicated data plane interface. Any other data plane interface will be used for East/West/North/South traffic depending on your configuration.
If you want to further separate data plane interfaces, you can create 2 Virtual Routes. One where you assign interfaces for East/West/North/South traffic and another one for management where you assign interface for traffic from Firewall itself for Panorama, NTP/License Check communication.
Thank you for your response.
So this article suggests it is possible https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGJCA0
however once you implement virtual routers this no longer is possible. That is correct?
"another one for management where you assign interface for traffic from Firewall itself for Panorama, NTP/License Check communication."
In this setup we move from using 2x interfaces to one interface for management? Is it not possible when using virtual routers to route the internet traffic(NTP) to a different interface and Panorama traffic to a different interface?
thank you for reply.
I did basic verification in Lab Firewall and the answer is yes to both. It is possible to assign different interfaces to different VRs and still use them as a service routes:
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!