Changing the panorama service route without causing a revert

[calvinmcelroy]

I am running into a problem  and looking for any ideas or experience that may provide a solution.

I have a firewall that is managed by Panorama and the service route for panorama is set to ‘default’. I want to change this route to communicate to panorama over an IPSec tunnel. This change causes a revert and I guess this is probably expected behavior because the connection is interrupted. How can I accomplish this change without a revert.

I have tried doing it from the firewall side and the panorama side. I’ve tried using specific policies that target panorama. I’ve tried every combination of configuration order that I can think of and still coming up short. Does anybody have any resource they could point me to?

[BPry · Accepted solution]

@calvinmcelroy,

Does your firewall have communication to panorama over the IPSec tunnel? There's a wait incorporated before the revert that would account for the routing change before it reverts the configuration, which makes it possible your change is actually breaking the communication back to panorama long-term. 

[calvinmcelroy · Accepted solution]

@BPry 

After checking panorama was not communicating over the vpn tunnel even with the service route changed and a any/any rule in place. I created a second rule that specifically targets the panorama servers and the interface for the vpn.  Fixed my issue.

thanks for the help