How do you deal with Service Route and MGT port redundancy?

[Maxstr]

We had an outage that took out a switch, and the PA management port is connected to that switch. I was unable to access the UI or CLI, and VPN was unable to authenticate via LDAP. I found the issue was that all the Service Routes were set to default using the MGT port.

After looking through the settings, I see that I can assign a Management Profile to multiple interfaces, which would allow me to access the UI/CLI if the management port goes down. But that does not include Service Routes, which can only be assigned to a single interface- either the MGT port, or a another interface.

Is it possible to make service routes redundant? Maybe something like a PBF rule for service routes?

[OtakarKlier]

Hello,

You have it correct for the managment interface. As for the service route, there is not one. Depeding on where the failure is, a HA pair might work.

But it depends.

Regards,

[aleksandar.astardzhiev]

Hi @Maxstr,

Unfortunately that is correct, service routes can be configured only through one interface.

However a workaround would be to configure service route based on destination. Take for example LDAP:

- You must leave the service route for LDAP on default

- On tab destinations configure two or more LDAP servers. Each server can be assignd with different interface

The catch here is that firewall will use the IP from the interface as source address when trying to connect to LDAP, BUT it will always perform route lookup first to check how to get to the LDAP server.

[TSilverline · Accepted solution]

Make the interface you want to attach the service route to a redundant (aggregate ethernet) interface.

[jeremy.larsen]

To add to TSilverLine - 

Aggregate ethernet going to two different switches (stacked, MC-LAG, etc)... 😃