How to reach the Palo Alto management interface form my internal network

Showing results for 
Show  only  | Search instead for 
Did you mean: 

How to reach the Palo Alto management interface form my internal network

L2 Linker


I'm fairly new to Palo Alto firewalls and just set up a home lab, but I have a problem accessing the management interface from my local network.


I have 4 network devices in my network:


- Modem/Router
- Palo Alto PA-500 (PAN-OS 7.1)
- Cisco 2960 switch
- Cisco 1602 AP


I'll try to explain how everything is connected, but I also added a picture of the topology which probably makes more sense then my explanation.




Router --> Palo Alto --> Switch --> AP


Router --> Palo Alto: subnet. Router is .1 and Palo Alto is .2


Palo Alto --> switch: One physical interface on the Palo Alto that has one subinterface ( which is configured as a DHCP server for wireless clients in VLAN 30). The switch side of this connection is configured as a trunk with all VLANS allowed.
The Palo Alto also has a (physical, dedicatec) management interface which has the address.
I also connected a cable from the Palo Alto's dedicated management interface to the switch. The switch port is an access port in VLAN99 (management).


Switch --> AP: The switchport is configured as a trunk with all VLANS allowed. The switch has an SVI named VLAN99 with IP address


The AP has 3 VLANS: 1 (unused), 30 (for wireless clients), 99 (Management VLAN and also native VLAN).
The BVI interface on the AP is configured with IP address


As you probably already guessed, I'd like to use VLAN99 (subnet as my management VLAN throughout my network.

Most of the things in my network are working fine. I can connect to the SSID associated with VLAN30, receive an IP address via DHCP and connect to the internet using my "wireless to outside" policy.


However, I'm struggling with setting up the dedicated management interface correctly.
Here's what I want to do: when I connect with my laptop to the SSID associated with VLAN30, I also want to be able to reach the management interface of the Palo Alto. So, packets need to be routed from the subinterface of VLAN30 to the management interface.
This is not what's happening now. In the logs I see that packets from (laptop) to (mgmt interface of palo alto) are hitting the policy "wireless to outside". The mgmt interface address is seen as an outside address.


Can anyone tell me how I can fix this. Maybe I configured my network all wrong, but can someone the please tell me what the best setup would be?


Thanks in advance for your ideas/help.




Accepted Solutions

@decosterstevenThere you go. It will never work if you keep that port in vlan99 as subnet 10.0.30.x is not part of vlan99. You need to keep it as trunk as you have multiple sub-interfaces configured on 1/3.




View solution in original post


Cyber Elite
Cyber Elite



Please check below few points -


1. Network Configuration on the PA interface where subnet If it is properly configured or there is some mis-configuration in subnet mask as you have management segment in 192.168.x.x.


2. Make sure on Management interface, you have enabled services like 443, ICMP etc to enable these services on MGMT interface. Also see permitted IP Addresses field.


As there is incorrect zone, please verity first point. I am suspecting issue with this. Also check what is gateway configured for MGMT interface and subnet mask.




Hi Mayur,


Thank you for your reply.


I changed the default subnet of the management interface from to

As default gateway I used, which is the outside interface of my palo alto that connects to my router. I also configured a default static route to (my router).

Can the management interface be put in a zone? I tried to configure this, but I cannot select the mgmt interface.





You can't configure security zone on MGMT interface. As you have configure MGMT IP as, make sure you have also configure proper gateway to this. Also enable services given in my earlier post. Now you should be good to go.


Hope it resolves your issue now!




Hi Mayur,


I see that I wrote a mistake in my previous post.

I ment that my default gateway under the management settings is (router) and not


So, what you are saying is that the ip address of my management interface should be in the same subnet as that of the link between my router and the palo alto ( in this case) ?



Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!