manage PAN device over a WAN, you might experience problems

[pnotpub]

Problem:
If you try to manage PAN device over a WAN, you might experience problems.
By manage, I mean via the Web interface, via CLI or via Panorama.
The Web interface may not load
Or
login via CLI works fine.
However a command that returns a lot of data will fail. One good example is "show log system"
Or
"Failed to establish SSL connection to Panorama Server: xxx.xxx.xxx.xxx Port:3978 Retry: 100000"

Solution:
In my case I solved (bypassed) the issue by adding the Router as a "Trusted IP" in PAN’s device tab.
PAN OS 3.1.6

Some more explanation:

A  ASCI drawing:
PAN <--> VPN router <----------------> VPN Router <--> PC /Panorama

Default Ethernet MTU is 1500. A packet inside a VPN tunnel can carry smaller payload (smaller MTU).
MTU - Maximum Transmission Unit or Maximum transfer Unit.
PMTU - Path MTU

I believe this to be a PMTU problem:
SSL / SSH packets does not like fragmentation, as this interferes with the encryption.
The PAN device sends all of its SSL / SSH packets with DF (Don’t Fragment Flag).
When the MTU is larger than the VPN router can send without fragmentation, the router replies with an ICMP “need fragmentation”.
The PAN management interface ignores all traffic that is not trusted (Trusted IP).
Hence a PAN device may fail to establish PMTU as it will drop / ignore traffic that originates from WAN routers.
(This is not necessarily an error, but more like a hidden stumbling block. )

For those interested: RFC 1191 adds some better explanation.
There is also another documented workaround: https://live.paloaltonetworks.com/docs/DOC-1649

/ Paul M

[rahmant]

I've seen this with many types of VPN interactions.  With a traditional Cisco remote access VPN installation, the typical process has the MTU of the client device's NIC set to 1300 bytes.  This typically resolves the fragmentation issue.

Tariq

[rahmant]

For followup, I have three PA units distributed globally (NJ - 2x2050's, Rotterdam - 1x500 and Singapore - 1x500) and all are being centrally managed by Panorama.  Pushes do take a bit of time to process (when don't they ), but still usable.  I haven't run into any connectivity problems where the connections would fail or anything (at least not yet).

Tariq