- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
01-07-2016 04:20 AM - edited 01-07-2016 04:31 AM
Hi,
I'm looking for a best practice when deploying Panorama accross multiple sites that do not really have any interconnections (and have quite a few overlapping subnets).
From what I understand, the firewalls themselves initiate the connection towards the Panorama instance (VM appliance in this case). The VM instance has one ethernet link.
So my question would be, which of these options would be considered the safest/most reliable way?
- Destination NAT the Panorama instance on a public routeable IP, ensure the management interface from each firewall has a path to it over port 3978 (possibly with a 0.5m patch cord from the management port to an internal port 🙂 )
- Create a site to site VPN to the location where the Panorama resides: from each firewall, specifically for Panorama
- Some other solution I haven't thought of yet
To give you an idea, we're talking roughly 35 devices (mainly 3020's and a few 5050-5060's), all configured in HA.
Also, do the Panorama timers (Receive/send Timeout for Connection to Device, Retry Count for SSL Send to Device,...) need to match between firewalls&panorama?
Thanks!
01-14-2016 03:26 AM
A service route can be used to change the interface used to connect to panorama to any of your dataplane interfaces instead of the management interface:
if possible I'd recommend using a site to site VPN to allow for more robust encryption (ipsec + ssl) if your connections are going to pass over an insecure/untrusted network.
not sure if the timers need to be identical but it would certainly be recommended to prevent any cascading timer issues
Tom
01-14-2016 03:26 AM
A service route can be used to change the interface used to connect to panorama to any of your dataplane interfaces instead of the management interface:
if possible I'd recommend using a site to site VPN to allow for more robust encryption (ipsec + ssl) if your connections are going to pass over an insecure/untrusted network.
not sure if the timers need to be identical but it would certainly be recommended to prevent any cascading timer issues
Tom
01-21-2016 02:41 AM
Hi Tom,
Thanks for your reply, I hadn't found that button yet. I'll figure the rest from here, thanks!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!