We had an outage that took out a switch, and the PA management port is connected to that switch. I was unable to access the UI or CLI, and VPN was unable to authenticate via LDAP. I found the issue was that all the Service Routes were set to default using the MGT port.
After looking through the settings, I see that I can assign a Management Profile to multiple interfaces, which would allow me to access the UI/CLI if the management port goes down. But that does not include Service Routes, which can only be assigned to a single interface- either the MGT port, or a another interface.
Is it possible to make service routes redundant? Maybe something like a PBF rule for service routes?
Solved! Go to Solution.
You have it correct for the managment interface. As for the service route, there is not one. Depeding on where the failure is, a HA pair might work.
But it depends.
Unfortunately that is correct, service routes can be configured only through one interface.
However a workaround would be to configure service route based on destination. Take for example LDAP:
- You must leave the service route for LDAP on default
- On tab destinations configure two or more LDAP servers. Each server can be assignd with different interface
The catch here is that firewall will use the IP from the interface as source address when trying to connect to LDAP, BUT it will always perform route lookup first to check how to get to the LDAP server.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!