Firewall management IP.

[Netwerx]

Can the ip address for the firewall web interface be reached through a virtual wire, or is it required that a https management profile be assigned to a layer 2 or 3 interface?

[HULK · Accepted solution]

Hello Sir,

You can't point the service route through a V-wire interface. You need to connect the management interface to a gateway device or configure an L3 interface ( or subinterface) on the firewall with management profile.

Thanks

[sraghunandan]

IP address of the firewalls management can be reached via virtual wire if the l3 device connected to one end of the virtual wire connects to the management interface through the vwire , else you can manage the device by configuring an interface management profile on a l3 interface.

[ericgearhart]

sraghunandan - just an observation, that's an extremely weird use case in my opinion. If you were going to do such a thing wouldn't you just use a tap interface, and a separate management interface?

Plugging Vwire back around and into the firewall management port would be extremely weird, to me. Not a best practice.

[sraghunandan]

Yes it is a weird use case and I have't seen anybody use it, I just provided a solution based on what he had requested.As you mentioned I would setup a separate management interface and instead of having it go through the vwire.

[ericgearhart]

Right, no worries. I just wanted to emphasize how weird it looked in my head

[pulukas]

I agree with Eric here, bending over backwards to get a mgmt connection to run through a v-wire is just weird.

The correct answer is what Hulk notes above.  If you use v-wire you need to configure a mgmt port or L3 interface separate from the v-wire in order to connect to and manage the Palo Alto.