Can Panorama manage Firewalls with Overlapping IP

[rimpey]

HI.

We have a requirement to manage a number of Palo Alto Firewalls. Some which have overlapping IP Addresses.

Is it possible for Panorama to manage an estate with this configuration almost like an MSSP

Many thanks

Richard

[gswcowboy]

I apologize in advance Richard but coud you please expand on your original question and perhaps elaborate by providing examples?

Regards,

Renato

[rimpey]

Sure

Say we had a customer that made an acquisition and want to bring the new firewall estate under management, but they are also using the same address space, that being 192.168.1.x

So would Panorama be able to differentiate between the 2 separate networks and manage them separately via “Device Groups” in essence Panorama see’s the 2 Firewall estates as different customers with different rules base.

I expect we would need another firewall between Panorama and the 2 networks and mayeb use NAT ?

Does that explain it better

[wittejj]

I would think that you could do it.  The key is that the management IP addresses for the PA devices would have to be accessible to Panorama.  I could think of the following scenarios to address it:

1)  The management IP addresses for the devices share a common network and that network is accessible to Panorama.

2)  The devices all have different external IP addresses and you set up a service route where the Panorama communications uses the external interface.

Another challenge that you would have to deal with is  to make sure that all object creation would be specific to each device group. In other words, none of the objects would be shared between the device groups..