HA Panorama Active/Standby deployment - Read only access only to standby Panorama´s Server

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

HA Panorama Active/Standby deployment - Read only access only to standby Panorama´s Server

L0 Member

Hi all, 

 

I have an environment with a lot of people wanting to get live traffic logs and policy rules for troubleshooting purposes, audit, etc., so we are thinking about to get all the read only admins connected only to the Standby web GUI and not to the active one and I´m not finding a way to get this done. We want to prevent this active panorama server connections to avoid resources overload on the active server do to many read only admins pushing traffic logs and policies at the same time, delaying the real administration tasks.   

 

As the standby is also getting all traffic logs and policy rules, we would like to give the read only admins access only to it.

 

Does someone knows if there is a way to accomplish this? 

 

Thanks in advance! 

2 REPLIES 2

Cyber Elite
Cyber Elite

you could start simply by drafting a user policy for the admins, directing them to only connect to panorama A or B, depending on their role, and adding a banner to the logon page reminding the admin they are logging on to the 'readonly' or the 'admin' panorama and should mind if this is the right one for them. 

 

the accounts are all synchronized across both panoramas, so it's not possible to have an account only on one panorama.

a few 'ideas'

-you could limit the source addresses allowed to connect to each panorama, or set up a jump host with only one panorama bookmarked in a locked down browser

-set the accounts to remote authentication via radius or tacacs+ and set a client IP (ip for panorama a or b) restriction policy on the authentication server (i.e. so a given username is only allowed to authenticate from the IP from panorama B)

 

before you tackle the technical solutions, consider if there a real need to block these admins or do you simply want a better 'spread'

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

Hi there, thanks a lot for your answer! 

 

Really appreciate your ideas! And yes, I really want to have them restricted to the standby Panorama server as we have a lot of admin users already, and don´t want all of them accessing the prod panorama as it´s affecting the overall performance of the platform. 

 

Thanks again!

  • 741 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!