10-14-2016 08:39 AM - edited 10-14-2016 08:40 AM
Hello,
I'm in the process of preparing two PA200s for our satelite sites. We are using Panorama to configure all of our firewalls and I'm trying to keep all my configs in the templates but am torn when it comes to the VPN configuration.
My main concern right now is that we haven't received our IP's and routing info from the ISP and we need to ship out the firewalls today. When the firewalls arrive, the only way to get a connection back to Panorama is via the tunnel which isnt complete. So my question is should I make the entire tunnel configuration a local config on the 200's (ike, ipsec, tunnel) or should I only make the tunnel and ikegw local since they will need to be configured by our local resources at the remote site?
What is the typical best practice for satelite vpn firewalls and panorama?
I would like to try and standardize the tunnel configurations but this makes it difficult if configurations need to be local. How have others done this in the past?
Thanks in advance!
~NH
10-22-2016 05:49 AM
Obviously too late a response for your shipping date, but figured I would add my comments.
Remote sites connected via the internet are a challenge and you have identified some of the issues. I have used two methods in past deploys:
Manage over VPN
In this one you have all traffic in a secure tunnel from mgmt to site and you identify the setup problems. Here I did use local config for the VPN so there was no dependency on mgmt to get up and running.
Manage via public interface
In this one the advantage is the VPN can have issues and I can still manage the device.
But we do need to be sure we lock down the mgmt access to only the ports and ip address that the mgmt system comes from. This also relies on the security of the actual communications between FW and Mgmt over the internet.
10-22-2016 05:49 AM
Obviously too late a response for your shipping date, but figured I would add my comments.
Remote sites connected via the internet are a challenge and you have identified some of the issues. I have used two methods in past deploys:
Manage over VPN
In this one you have all traffic in a secure tunnel from mgmt to site and you identify the setup problems. Here I did use local config for the VPN so there was no dependency on mgmt to get up and running.
Manage via public interface
In this one the advantage is the VPN can have issues and I can still manage the device.
But we do need to be sure we lock down the mgmt access to only the ports and ip address that the mgmt system comes from. This also relies on the security of the actual communications between FW and Mgmt over the internet.
10-24-2016 06:29 AM
Thanks for the good info. I ended up doing a hybrid of both for my situation. I set up the external interface as an alternate management interface and locked it down to our corportate public range. As for the VPN I left the configuration as template based and figure if I have any issues the day of, I will be able to override the template via the management external connection.
Cheers!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
