Firewalls accessing Panorama: best practice
cancel
Showing results for 
Search instead for 
Did you mean: 

Firewalls accessing Panorama: best practice

L3 Networker

Hi,

 

I'm looking for a best practice when deploying Panorama accross multiple sites that do not really have any interconnections (and have quite a few overlapping subnets).

From what I understand, the firewalls themselves initiate the connection towards the Panorama instance (VM appliance in this case). The VM instance has one ethernet link.

 

So my question would be, which of these options would be considered the safest/most reliable way?

- Destination NAT the Panorama instance on a public routeable IP, ensure the management interface from each firewall has a path to it over port 3978 (possibly with a 0.5m patch cord from the management port to an internal port :-) )

- Create a site to site VPN to the location where the Panorama resides: from each firewall, specifically for Panorama

- Some other solution I haven't thought of yet

 

To give you an idea, we're talking roughly 35 devices (mainly 3020's and a few 5050-5060's), all configured in HA.

 

Also, do the Panorama timers (Receive/send Timeout for Connection to Device, Retry Count for SSL Send to Device,...) need to match between firewalls&panorama?

 

Thanks!

1 ACCEPTED SOLUTION

Accepted Solutions

L7 Applicator

A service route can be used to change the interface used to connect to panorama to any of your dataplane interfaces instead of the management interface:

2016-01-14_12-19-14.png

 

if possible I'd recommend using a site to site VPN to allow for more robust encryption (ipsec + ssl) if your connections are going to pass over an insecure/untrusted network.

 

not sure if the timers need to be identical but it would certainly be recommended to prevent any cascading timer issues

 

Tom

Tom Piens
Like my answer? check out my book! https://bit.ly/MasteringPAN

View solution in original post

2 REPLIES 2

L7 Applicator

A service route can be used to change the interface used to connect to panorama to any of your dataplane interfaces instead of the management interface:

2016-01-14_12-19-14.png

 

if possible I'd recommend using a site to site VPN to allow for more robust encryption (ipsec + ssl) if your connections are going to pass over an insecure/untrusted network.

 

not sure if the timers need to be identical but it would certainly be recommended to prevent any cascading timer issues

 

Tom

Tom Piens
Like my answer? check out my book! https://bit.ly/MasteringPAN

View solution in original post

Hi  Tom,

 

Thanks for your reply, I hadn't found that button yet. I'll figure the rest from here, thanks!

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!