Firewalls accessing Panorama: best practice

[Arne-VDH]

Hi,

I'm looking for a best practice when deploying Panorama accross multiple sites that do not really have any interconnections (and have quite a few overlapping subnets).

From what I understand, the firewalls themselves initiate the connection towards the Panorama instance (VM appliance in this case). The VM instance has one ethernet link.

So my question would be, which of these options would be considered the safest/most reliable way?

- Destination NAT the Panorama instance on a public routeable IP, ensure the management interface from each firewall has a path to it over port 3978 (possibly with a 0.5m patch cord from the management port to an internal port 🙂 )

- Create a site to site VPN to the location where the Panorama resides: from each firewall, specifically for Panorama

- Some other solution I haven't thought of yet

To give you an idea, we're talking roughly 35 devices (mainly 3020's and a few 5050-5060's), all configured in HA.

Also, do the Panorama timers (Receive/send Timeout for Connection to Device, Retry Count for SSL Send to Device,...) need to match between firewalls&panorama?

Thanks!

[reaper · Accepted solution]

A service route can be used to change the interface used to connect to panorama to any of your dataplane interfaces instead of the management interface:

if possible I'd recommend using a site to site VPN to allow for more robust encryption (ipsec + ssl) if your connections are going to pass over an insecure/untrusted network.

not sure if the timers need to be identical but it would certainly be recommended to prevent any cascading timer issues

Tom

[Arne-VDH]

Hi  Tom,

Thanks for your reply, I hadn't found that button yet. I'll figure the rest from here, thanks!